User creates project
        │
        ▼
Project name stored in database
        │
        ▼
Administrator opens Campaign / Email / Form
        │
        ▼
Project tag & popover rendered
        │
        ▼
Project name inserted into HTML without sanitization
        │
        ▼
Browser executes embedded JavaScript

Attacker
    │
    ▼
Creates a project with a malicious project name
    │
    ▼
Payload stored in database
    │
    ▼
Administrator views Campaign / Email / Form
    │
    ▼
Administrator hovers over the project tag
    │
    ▼
Popover renders unsanitized project name
    │
    ▼
Browser executes JavaScript
    │
    ▼
Actions performed with administrator's privileges

// Project name retrieved from the server
const projectName = response.project.name;

// Unsafe: inserts user-controlled HTML
popover.innerHTML = `
    <span class="project-tag">
        ${projectName}
    </span>
`;

const tag = document.createElement("span");
tag.className = "project-tag";

// Safe: treat input as plain text
tag.textContent = response.project.name;

popover.replaceChildren(tag);