XSS

At first this looks like XSS, but it isn't. The plugins (multitext, tags, key/value, ...) were just using the raw input for building their elementlist.

If you entered XSS-like text it was just handled as HTML and append, and therefore it look like it was XSS. But when it was saved to the database Spoon handled the raw HTML correctly and escaped all special chars.

When the form was shown again the plugin builds the list again, and thus made the same mistake.