Persistent XSS Vulnerability Exposing Cookies on XWiki Platform

A persistent Cross-Site Scripting (XSS) vulnerability has been identified in the XWiki platform where a malicious script can be injected through the "HTML code" input field in the editor. The payload executes every time the affected page is loaded, triggering a JavaScript confirm() popup that reveals the browser's cookies. This could lead to session hijacking if an attacker is able to steal sensitive session data from other users.

Steps to Reproduce:

1. Open the XWiki editor.
2. In the "Content" field, paste the following payload in a html macro
   "></div><details/open/ontoggle=confirm(document.cookie)></details>

1. Save and view the page.
2. Upon visiting the page again, the confirm() dialog with the document's cookies is displayed, indicating the XSS vulnerability.