XSS in HTML Tidy plugin used in WYSIWYG HTML editors

["Steven M. Christey" <coley () linus mitre org>]

http://www.securityfocus.com/bid/31908 covers a claimed issue in Kayako
eSupport that probably stems from an XSS in some plugin called HtmlTidy
which is for some WYSIWYG HTML editor called htmlArea.  Quick Google
searches suggest it may be in extensive use in various packages;
squirrelmail and Dragonfly were some of the products I've heard of that
popped up in early results.  I didn't dig deeply though.

This will have a CVE momentarily, but this post should be in the initial
CVE.  Chicken and egg thing basically...

- Steve