AIKIDO-2026-530137

TL;DR

When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py builds the cms-rendering-exception heading by interpolating the exception message, placeholder and source strings, and the plugin's get_short_description() directly into an HTML string, then returns that placeholder output as safe markup. Stored content that reaches those values is parsed as HTML in a staff user's browser when the plugin later raises during edit-mode rendering, producing stored cross-site scripting in the CMS editing context. Enabling DEBUG does not mitigate the issue because the custom heading renders regardless of the traceback HTML. The fix escapes the heading with format_html before returning it as safe markup.