Cross site scripting

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element...