@Waline/Client (<= 3.15.2)

Waline versions 3.15.2 and prior are vulnerable to stored cross-site scripting in the @waline/client UserList widget. An unauthenticated attacker can inject malicious payloads into comment metadata that execute in the browsers of page visitors.