Cross-user script execution via stored module code

Stored XSS in vxcontrol SOLDR 1.1.0 allows remote authenticated users to run scripts in another user's browser via the module editor. The editor stores attacker-controlled JavaScript in a module's main.vue file and renders that file as executable content when the module is opened. A low-privileged account must create or edit a module, and a higher-privileged user must open it; the script then acts with the victim's application privileges and can access the WebSocket service through the valid origin.