The `evalImageTypeValue()` function in `BackendWidgetsLists` interpolates the result of `ImageResizer::filterGetUrl()` into a single-quoted image source attribute without proper escaping. When a third-party plugin renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim. This allows an attacker to break out of the attribute and inject arbitrary attributes, such as event handlers, which execute in the session of the backend user viewing the list. A default installation is unaffected as the core does not ship with an image list column; exploitation requires a plugin that renders attacker-influenced values through one.