Steemit NoScript Zappl XSS Cross Site Scripting Warning

I just cama across zappl.com and got this warning:

NoScript detected a potential Cross-Site Scripting attack

from [...] to https://zappl.com.

Suspicious data:

(URL) https://zappl.com/{{ngMeta['og:image']}}