Edito CMS contains a stored cross-site scripting (XSS) vulnerability in the /api/auth/profile endpoint. An authenticated attacker can inject malicious scripts into the givenName and surname parameters. These scripts execute automatically when an administrator views the admin changelog logs. The vulnerability has been fixed in version 5.10.2607, with hotfixes available for older 5.8 versions.