In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.
An attacker needs privileges to create a project or edit an existing project, and must be able to place an XSS payload in the project name. Exploitation also requires a user to visit the vulnerability-scan scheduling page where the stored project name is rendered.
Archery versions before 1.3 are affected. The issue is in the handling of project names on the vulnerability-scan scheduling page.
Restrict project creation and editing privileges to trusted users, and review existing project names for injected script content. Avoid visiting the vulnerability-scan scheduling page with accounts that have elevated privileges until affected project names have been remediated.