In curent ZK release:
DSP Servlet is part of zweb, which is loaded as dependency from zk.jar for most projects.

dsp servlet returns a number of potential XSS vulnerabilities from security scanning, in ForEach and InterpreterServlet
From initial checks, theses vulnerabilities are inherent to page composition in with dsp.

This doesn't affect ZK unless the dsp server is activated in web.xml, but it could be beneficial to externalize dsp servlet to it's own package, and make it available for users requiring it, but not included by default.

See attached scan (performed on zk 7.0.5) for details on the possible XSS vulnerabilites