Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.

Source