PhpSpreadsheet versions prior to 5.7.0, 3.10.5, 2.4.5, 2.1.16, and 1.30.4 contain a stored cross-site scripting (XSS) vulnerability in the HTML writer. This occurs because the code conditionally applies HTML escaping only when the formatted cell data matches the original data. Custom number formats using the '@' text placeholder with additional characters cause the escaping to be skipped, allowing unescaped HTML injection. This can lead to stored XSS when user-uploaded XLSX files are converted to HTML and displayed to other users.