Smart School 7.0 contains a stored Cross Site Scripting (XSS) vulnerability due to insufficient validation of user input in the '/online_admission' POST request parameters such as 'firstname', 'lastname', and 'guardian_name'. This flaw allows an authenticated remote attacker to inject malicious scripts that could execute in the context of other users, potentially stealing session cookies.