Cross site scripting via input unit widget
ImpactAuthenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).PatchesUpdate to Contao 4.9.42, 4.13.28 or 5.1.10.WorkaroundsDisable login for all untrusted back end users.Referenceshttps://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-unitsFor more informationIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).CreditsThanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.