Postiz, an AI social media scheduling tool, allows any authenticated user to embed arbitrary HTML into post content. During the period before version 2.21.7, the preview page renders that stored HTML using dangerouslySetInnerHTML on the main application origin. This flaw enables an attacker to inject and execute client‑side scripts in the browser of any user who accesses the public preview link, potentially stealing session data, performing credential theft, or propagating malicious content.

The vulnerability affects GitroomHQ Postiz App version 2.21.6 and any earlier releases up to just before 2.21.7. Users who can create posts are able to exploit the flaw by tampering with their save request and then sending the resulting preview URL to another user.

The CVSS score of 8.9 categorizes this as a high‑severity issue. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers only need authenticated access to create a post and the ability to share the preview link, making the exploitation path straightforward. The stored XSS could execute arbitrary code in the victim’s browser without requiring additional privileges or complex conditions.