Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.