When integrating RSS feeds Confluence converts "<" and ">" to "<" and ">". This allows the integration of arbitrary javascript into the generated HTML output. Because Confluence seems to allow cross-site-request-forging it may even be possible that a website issues the request to create the page with the infected RSS feed on behalf of the user.