The Silverstripe Framework, a PHP framework powering the Silverstripe CMS, has an intentional feature allowing form messages to contain HTML markup for links and other relevant content. However, some form messages include user-provided content that does not get correctly sanitized before being included, resulting in an XSS vulnerability. There are no known workarounds for this issue.