An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.
CWE-79