Stored XSS via unescaped playlist name setting

Stored cross-site scripting in InfoD 74 Embed Peertube Playlist before 1.10 allows remote authenticated users to execute scripts via settings. The plugin stores the playlist Name field without adequate sanitization and returns it to the administration page without output escaping, so an event-handler payload executes when the field is viewed. High-privilege access, such as an administrator account, is required, and exposure is limited to multisite installations or sites where unfiltered_html is disabled.