Stored XSS via export innerHTML reparse

Stored XSS in HTML export in WeKan 8.72 through 10.22 allows remote authenticated users to execute script via a card title. In addBoardHTMLToZip() in client/lib/exportHTML.js, the export click handler reads card title and body with textContent, which decodes entity-encoded markup, then concatenates titleText and allText into content.innerHTML in the generated index.html, causing a second HTML parse that revives attacker-supplied handlers. Board-member access is required and a recipient must open the downloaded export and click the malicious card; the script runs in the export document and can exfiltrate all board data included there, including cards added after the attacker's membership was removed.