HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address

Note: This report is similar to #1842867 but has the administrator manually confirming an unconfirmed email on the attacker's behalf, instead of impersonating the attacker's account.

  def confirm_user_data(user)
    message = if user.unconfirmed_email.present?
                _('This user has an unconfirmed email address (%{email}). You may force a confirmation.') % { email: user.unconfirmed_email }
              else
                _('This user has an unconfirmed email …