Michael Kapfer

The issue allows an attacker to make logged-in high-privilege users change settings and set Cross-Site Scripting payloads due to the lack of a CSRF check when saving settings and the failure to escape some settings when outputting them.

The issue is related to a Cross-Site Scripting (XSS) vulnerability. It is associated with the Referer header.