We discovered that one can store unsanitized HTML in the GeoMap plugin under the Attribution text field and it will be processed by the client. The vulnerability makes it possible to use XHR to make arbitrary API calls on behalf of the attacked user. This means that a malicious user with editor permissions could alter a GeoMap panel to include JavaScript that changes the password for the user viewing the panel (this could be an admin) to a known password, thus getting access to the admin account (so the editor would become an admin as an end result).