Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (
a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the
<cite> tag to be allowed so people can include citation metadata in the script.
So, the question is, does allowing the
<cite> tag to be used in user-submitted content expose any XSS (or similar) vulnerabilities? As far as I can tell, the tag is harmless as it only contains metadata (which may be rendered by extensions or the like).