Lvshenlyl

An issue exists where unauthenticated attackers can perform stored HTML injection by submitting crafted data through Lead Capture public forms. The request body is stored in the `LeadCaptureLogRecord.data` variable and is rendered without escaping when viewed by administrators. While the Content Security Policy prevents the execution of JavaScript, HTML content can still be injected.

An authorization flaw allows an authenticated site member to read excerpts of posts they are not permitted to access, specifically affecting gated content.