Watchlist dumps user's password hashes in its regular update mails

Watchlist regularly sends the diff of the changes on the watched documents for the past day. In this diff, new users or users that have updated their passwords will have their password hash printed out in the diff of the email that Watchlist sends out.

This is caused by XWIKI-5261, but even so, Watchlist (or the underlying new/old diff module used by Watchlist) could simply choose to skip Password properties altogether, in an attempt to limit the proliferation of password hashes outside XWiki.