Privilege escalation via unencoded stored list name

Stored cross-site scripting in phpList 3.2.6 allows remote authenticated users to execute script through a crafted list name. The administration interface stores a list name and echoes it without output encoding across list, member, import, and campaign views. An account permitted to create lists is required, and the script runs when another user opens an affected administrative view, enabling privilege escalation within that user's session.