silverstripe/framework's `Member.Name` is not escaped
The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name".If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because Member->getName() just returns the raw FirstName + Surname as a string, which is injected directly.