Administrator-session script execution via stored XSS

Stored XSS in WebPros cPanel and WP Squared's WHM Mass Modify Accounts interface lets remote authenticated users run script in an administrator session. The interface renders stored account-holder content as executable script; the vendor has not identified the affected field or rendering code. Exploitation requires an account holder to plant content and a WHM administrator to view the interface, after which the script can perform administrative actions in that session.