Stored XSS into HTML context with nothing encoded