Stored cross-site scripting occurs when a user with customer privileges uploads an SSL certificate. The Certificates API `add()` and `update()` methods use `openssl x509 parse()` to process the certificate and store the issuer organization `issuer['O']` value without sanitization. Because the table-listing renderer uses the Twig `raw` filter, which disables HTML auto-escaping, the malicious value executes as a script when an administrator or reseller views the SSL certificates section. This allows a privilege escalation from a customer to an administrator, potentially leading to full account takeover. Since administrators control webserver, DNS, and PHP configurations via a root-level cron job, this can be further escalated to remote command execution as root on the server.