GHSA-7pr4-wx9w-mqwr

## Summary Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. --- ## Proof of Concept ### Required Permissions (Attacker) - Admin access (only admins have access to the settings page) - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft). ### Steps to Reproduce 1. Log in as an attacker. 2. Go to **Settings** -> **Entry Types** (`/admin/settings/entry-types`). 3. Create a new Entry Type. 4. Set **Name** to: ```html <img src=x onerror="alert('XSS-EntryTypes')" hidden> ``` 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.