Your LNDHub connection string will be saved un-encrypted in localStorage so there is that risk, but its the same as Snort having some XSS and draining your WebLN wallet (if you didnt have quota)

Not that there are any *known* XSS issues on Snort