Edr4

The issue is related to Cross-site Scripting (XSS) - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the application, potentially allowing the attacker to steal user data or take control of user sessions.

The issue concerns cross-site scripting via malicious RSS feeds. An administrator can import a malicious RSS feed containing Cross Site Scripting (XSS) payloads inside RSS links. When victims visit the RSS content and click on the link, they will execute the Javascript.

The issue is related to the lack of neutralization of HTML tags during web page generation, which can allow a remote attacker to conduct a cross-site scripting attack. The affected versions do not properly neutralize HTML tags in the global search context.