- Create a user with username "><script>alert('hahahaha')</script>
- User creates a personal space
- Try to add a page to the personal space
This is caused by
<meta id="confluence-space-key" name="confluence-space-key" content="$spaceKey">
However since the personal space doesn't work too well with usernames with crazy letters, I don't think its a Blocker.