Typemill CMS < 2.23.0 - Cross-Site Scripting

Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint du...