User Input that is reflected in a JavaScript Context is not properly sanitized. The User Input is reflected inside of a single-quoted string and single-quotes are encoded. However, there is an issue with the entity removing HTML <script> tags that prevents single-quotes from being encoded. This allows breaking out of the string context and injecting user input into a JavaScript context, resulting in XSS. The issue is patched in 7.12.9.