Prerequisites

• An administrator account
• allowAdminChanges must be enabled in production, which is against security recommendations.

Steps to Reproduce

1. Navigate to Settings → Fields and create a new field with Type: Table
2. Add a Column Heading and set Column Type to Row Heading
3. In Default Values section, add a row with the following payload:

<img src=x onerror="alert('XSS')">

1. Enable Static Rows
2. Use the field in any object (e.g., user profile fields) → then visit any user’s profile
3. Notice the XSS execution

Resources