Persistant XSS vulnerabulity through document titles.

If a user sets a document title to include script, then it is executed on load of the document.
The script is injected through the breadcrumb trail title below the breadcrumb trail.

Create a document, set title to:

<script>alert("haxd")</script>

This also works for users who sign up with that as their first or last name because those values are set as the title of the document.