You are allowed to inject and execute scripts in web content title

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.0.X, 7.1.10 DXP FP26, 7.1.10.7 SP7, 7.1.X, 7.2.10 DXP FP15, 7.2.X, 7.3.10.3 DXP SP3, 7.3.X, 7.4.2 CE GA3, 7.4.13 DXP GA1, Master
• Component/s: Accessibility
• Labels:
  • ee-ts
  • liferay-dxp-71-sp7
  • liferay-dxp-73-sp3
  • liferay-fix-pack-dxp-3-7310
  • liferay-fixpack-dxp-15-7210
  • liferay-fixpack-dxp-26-7110
  • liferay-fixpack-dxp-3-7310
• Branch Version/s:
  7.3.x, 7.2.x, 7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Fix Priority: 3
• Git Pull Request: https://github.com/liferay-frontend/liferay-portal/pull/1180

Description: You are allowed to inject scripts in web content title.

Steps:

1. Navigate to Product Menu > Content & Data > Web Content
2. Add a Basic Web Content with title '<script>alert(123);</script>' and a content
3. Publish it
4. Edit the Web content

Expect result: No Alert.
Actual result: Alert 123 displayed.