Steps to reproduce:
- As a user with some HTML code in the name (like <script>alert(1)</script>), do some change on a document that is watched by another user. Additionally, set the title of the changed document to contain similar HTML code.
- As the other user, click on the feed icon in the notifications area.
The user's name is displayed as entered as is the title of the changed document.