CVE-2018-14849: Improper Neutralization of Input During Web Page Generation

Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php...