I could be wrong, but it looks like it's used to create mini-sites, so being able to use Javascript seems more like a feature than an xss vulnerability.