Stored XSS via unsanitized slider caption title

Stored XSS in Swift Ideas Swift Framework before 2024.04.30 allows remote authenticated users to execute JavaScript in an administrator's browser. The slider Caption Title setting accepts an HTML event-handler payload without sanitization and renders the stored value without output escaping on the slider administration page. Contributor access is required, and execution occurs only after an administrator opens the Swift Slider management page; the demonstrated effect is script execution in that browser context.