XSS vulnerability can be exploited with the pagetree macro

Use the following markup:

{pagetree:root=<script>alert('12')</script>}

Whenever the page is viewed, the script will be executed.