A user can supply malicious HTML and JavaScript code that will be executed in the client browser
CWE-79, CWE-79