An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
CWE-79, CWE-779