Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize node titles when displaying the orphaned nodes report. This allows an attacker with permissions to create content of a type configured for the orphaned nodes report to inject malicious scripts. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites.