- Create a user with username "><script>alert('hahahaha')</script>
- User creates a personal space
- Try to add a page to the personal space
This is caused by
However since the personal space doesn't work too well with usernames with crazy letters, I don't think its a Blocker.