See the pull request at https://github.com/remotelearner/moodle-mod_questionnaire/pull/27

In the db/access.php capabilities that allow the user to insert javascript should have their risk mask declare RISK_XSS for complete documentation.

Update these capability declarations to declare this:

mod/questionnaire:editquestions
mod/questionnaire:manage