The issue concerns stored cross-site scripting (XSS) in the New User module, specifically at the "/opencms/system/workplace/admin/accounts/user new.jsp" endpoint. An attacker can insert arbitrary JavaScript as user input, such as in the `First Name` or `Last Name` fields, which will be executed whenever the affected snippet is loaded.