1. Create a user with username "><script>alert('hahahaha')</script>
2. User creates a personal space
3. Try to add a page to the personal space

This is caused by

<meta id="confluence-space-key" name="confluence-space-key" content="$spaceKey">

However since the personal space doesn't work too well with usernames with crazy letters, I don't think its a Blocker.