The mermaid diagrams in this app are rendered via the outdated mermaid library (< v11.10.0). There is a known CVE for it: https://security.snyk.io/vuln/SNYK-JS-MERMAID-12027649
As a result, an attacker may trigger a Stored XSS on app domain (http://macro-pack.atlassian0.com ).

Steps to Reproduce

1. Call the Macro Pack macro (start with /macro somewhere on a page).

2. Use text as a source and this content as a value (you can also copy the PoC from advisory page):

   sequenceDiagram participant A as Alice<img src=x onerror=alert(document.domain)>$$\\text{Alice}$$ A->>John: Hello John, how are you? Alice-)John: See you later!

3. Save the diagram and reload the page -> XSS fires.