A stored cross-site scripting issue exists where authenticated users with `post.create` or `post.edit` permissions can inject scripts through unsanitized LaraBuilder `design json` block content. This occurs when attackers save text-editor, HTML, text, or heading blocks containing script or event-handler markup, which then executes within the sessions of administrators or Superadmins when they view the builder, preview, or page.