Multiple stored cross-site scripting (XSS) vulnerabilities were found in the Episerver Content Management System (CMS) by Optimizely. Authenticated users with at least the 'WebEditor' role could inject malicious JavaScript code into rich text editor (RTE) properties in the CMS's Edit section. This malicious code would execute when other users preview the affected pages. The vulnerabilities affect specific versions of EPiServer.CMS.Core and EPiServer.CMS.UI in the 11.x and 12.x release lines.