Authenticated stored XSS via unsanitized variable names

Stored cross-site scripting in FUEL CMS 1.4.11 allows remote authenticated users to execute script in other visitors' browsers via crafted Blocks, Navigation, or Site variable names. The affected fields store attacker-controlled attribute text and render it without adequate neutralization, so event-handler payloads execute when administrative or public pages display those values. An authenticated CMS account is required to plant the payload, while visitors need only load a page containing the stored value; reported impact includes cookie theft and other actions performed in the victim browser.