Stored XSS via email body text area

Xporter should be able to handle XSS attack from the email body text area.
The user will be able to add scripts that may run when we are listing the scheduled reports/post functions actions.

Cross-site scripting attacks occur when you manage to sneak a script (usually javascript) onto someone else's website, where it can run maliciously.
XSS is possible when you have user input into a web site. For instance, if I was filling out a web form, and it asked me for templates description, I could enter:

Template Description: "<svg/onload=alert(1)>"