Step to reproduce:
1) Go to workflow edit page as an administrator
2) Add validator "User Permission Validator" to transition with user name parameter "<script>alert(2)</script>"
3) It will trigger xss on ViewWorkflowTransition page