Cross site scripting

In the "Time in Status" app before 4.13.0 for Jira, remote authenticated attackers can cause Stored XSS...