GHSA-7pr4-wx9w-mqwr

Summary

Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.

Proof of Concept

Required Permissions (Attacker)

• Admin access (only admins have access to the settings page)
• allowAdminChanges is enabled in production, which is against our security recommendations.

Steps to Reproduce

1. Log in as an attacker.
2. Go to Settings -> Entry Types (/admin/settings/entry-types).
3. Create a new Entry Type.
4. Set Name to:

<img src=x onerror="alert('XSS-EntryTypes')" hidden>

5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically.
6. Notice the alert fires when the entry types table renders.