System Administrator is allowed to input JS/CSS in Macro Title and Icon URL in Macro Editor. The script input in the fields can be executed when user open "Macro" selection window.
- Go to "Edit User Macro" as Confluence Administrator.
- Input "'"><img src=x onerror=alert(1)>" in Macro Title field.
- Input "http'"><img src=x onerror=alert(3)>" in Icon URL field.
- Click save.
- Go to a certain page to edit.
- In edit UI, Select "+" then select "... Other Macros".
- Popups appear as alert(1) and alert(3) as set.
- JS/CSS should not be allowed in Macro Title and Icon URL.