Use the following markup:
{userlister:groups=<script>alert('Vulerable')</script>}
Whenever the page is viewed, the script will be executed.