Yii framework’s CmsInput extension versions 1.2 and prior suffer from an improper cross site scripting sanitation implementation.