Stored script execution via unsanitized group names

Stored XSS in Piwigo 2.10.1 group management allows remote authenticated users to execute scripts in another user's browser. The group_list page accepts an HTML event-handler payload in the groupname field, stores it as a group name, and later renders it without safe output encoding. Access capable of adding groups and a separate user's visit to the affected administrative page are required; successful execution can read or alter data available to that browser session.