GHSA-wc6r-4ggc-79w5: Stored XSS using HTMLEditor

A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.

An attacker must have access to the CMS to exploit this issue.