XSS vulnerability can be exploited using the Gallery macro

Upload an image to a page, and include the following in the attachment comment:

<script>alert('vulnerable')</script>

Now display the image using the gallery macro. When the full-size picture is viewed, the script in the comment will be executed.

See example here: https://qa-cac.atlassian.com/display/~mhrynczak/xss+in+gallery