Edito CMS has a stored cross-site scripting (XSS) vulnerability in its avatar upload functionality. An authenticated attacker can inject arbitrary HTML and JavaScript code, which will be executed when a user visits a URL displaying the manipulated avatar. This vulnerability allows persistent script injection affecting users who view the compromised avatar. The issue is fixed in version 5.10.2607, with hotfixes available for older 5.8 versions.