nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \\Presentation\\Nop.Web\\Areas\\Admin\\Controllers\\NewsController.cs and \\Presentation\\Nop.Web\\Areas\\Admin\\Controllers\\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/id Admin/Blog/BlogPostEdit/id. NOTE: the vendor reportedly considers this a \feature\ because the affected components are an HTML content editor.