XSS in Import Image

Hi, I would like to report an issue.

Description:
There's an XSS on in image import function ( image: ). It's available only for logged in users, who are allowed to create new posts, but can lead to stealing admin user's credentials.

Steps to reproduce bug:

1. Go to page edition (for example: https://playground.xwiki.org/xwiki/bin/edit/Sandbox/WebHome
2. Select "Source" button
3. In source enter for example:

[[image:test||alt="" width="1" height="1" onerror="alert(document.location)"]]

1. Click "Preview"
2. There's XSS.

Contact:
If you want to get further information, mail me at: kmpl@protonmail.com