Stored XSS via unescaped deletion reason

Stored XSS in comment-deletion notifications in HumHub 1.18.4 allows remote authenticated users to execute script in a victim session. A Space administrator can place HTML or JavaScript in the deletion reason, and CommentDeleted::html() interpolates that reason into notification HTML without encoding before the server returns it in response.output and the client appends it to the notification dropdown DOM. Exploitation requires Space-administrator access and the victim to open the notification UI; if the victim has broader privileges, the script can perform same-origin actions such as administrative account changes.