Is it though? the result isn't used in any place that's prone to rss, they are only used in $.val() and $.text() which both do html encoding.

I've tried creating a note ```<script>alert('xss');</script>``` as title and it doesn't trigger anything.

I'm not the xss export though.