Stored XSS Diary

Challenge Question

This internal team diary lets anyone post an entry, and an admin account periodically reviews new posts while logged in with an active session. Whatever HTML or script ends up in a post gets rendered exactly as submitted the moment that session loads the page. Get it to hand over something only it should have.