Users can be tricked to execute scripts as the create action doesn't display the page's title

Steps to reproduce:

1. Get a victim with script or programming right to open <xwiki-host>/xwiki/bin/create/NonExistingSpace/WebHome?title=$services.logging.getLogger(%22foo%22).error(%22Script%20executed!%22) where <xwiki-host> where is the URL of your XWiki installation, making the victim think that this URL should be used to create a document (e.g., by faking a create button). Get the victim to click on the create button on that screen.

Expected result:

The victim sees the malicious title such that the victim can correct it before it is executed (or just close the browser's tab).

Actual result:

The title is not displayed in the create action, only in the edit action - and at that point, the code has already been executed, demonstrated by a log message with content "Script executed!" in this case. The script execution could easily be used to redirect the victim to another URL to hide the attack. If the victim has programming right, this gives full remote code execution with programming rights.

From what I can see, XWIKI-12316 is the first change where inputs were hidden while creating documents, thus making this attack possible (in these versions, the name was used as title without escaping from what I can see). This gives a likely affects version of 7.2-milestone-2. The title parameter that is exploited here was introduced in XWIKI-12231, so in 7.2-milestone-3 this is also exploitable with the title parameter.