Some WebEngine templates don't properly escape their variables and thus are XSS vectors.
no_site.ftl / no_blog.ftl:
http://localhost:8080/nuxeo/site/sites/%3Cimg%20src=.%20onerror=alert(123)%20%3E
list_sites.ftl:
Use a blog name <img src=. onerror=alert(4) >
error_create_page.ftl:
?