XSS vulnerability can be exploited with the Userlister macro

Use the following markup:

{userlister:groups=<script>alert('Vulerable')</script>}

Whenever the page is viewed, the script will be executed.