...
When you add fields to a custom element, page metadata, custom content type and/or a panel that accept HTML or JavaScript and/or are rendered without any escaping mechanism, they should only be accessible to roles with at least the Administrator permission group assigned.
...