Product
The @waline/client component (version 3.15.2 and prior) renders the comment editor's live preview without sanitization, allowing unauthenticated attackers to perform stored XSS against administrators or moderators who edit the malicious comment.