[cujanovic]

This is vulnerable to XSS, payload: [Click Me](javascript:this;alert(document.domain))

[stevekemp]

Or even the more naive "<script>alert(3)</script>" - which was the second thing I tried.