Vulnerable to script injection?

This question is only viable if the RTE processed your data, which it doesn't as we do not know how the end user wants to process the data they take from their web forms.

The RTE is like a blank canvas you simply apply it to your sites own existing web forms.

How you process and filter the data from your sites web forms once it is submitted is completely up to you, the RTE doesn't handle this side of things as what you do with the data from your forms could be anything, as you may want the data for emails, databases, etc.

As you apply the RTE to an already existing form on your site then you should already have measures in place that filter this type of thing.