Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text"

I've identified Stored XSS vulnerability in concrete5 **Conversations** module, when Active Conversation Editor is set to "Rich Text". An attacker is able to input malicious JavaScript, which is run in both client (agains any site visitor) as well as against any user logged into admin panel and …

'use strict'
const msg = 'This file is loaded from bl4de.tech domain and executed in context of ' + document.domain;
console.log(msg)
window['alert'](msg)