A stored cross-site scripting issue exists where an authenticated attacker can execute arbitrary JavaScript in another user's browser. This occurs by injecting a crafted payload into the title of a Discussion within the Q&A category. The `AnsweredQuestionStructuredDataComponent` fails to escape user-controlled Discussion titles before embedding them in a `<script type="application/ld+json">` block, enabling the title to break out of the script context. The attack is further escalated by leveraging JSONP (JSON with Padding, a technique to allow cross-domain data requests) callback support in the REST API to bypass the Content Security Policy.