Steps to reproduce:

1. Login as administrative user
2. Create a new proxy host entry with the payload <script>alert('XSS')</script>.google.com as domain
3. Hit save
4. Try to delete the newly added proxy host. XSS payload is executed.

Recommendation:

Implementing input validation and/or ensuring output sanitization as done for all other inputs/outputs.

Risk:

Low risk since high privileges are required.