Stored XSS in name selection

How it was found

You have a stored XSS vuln when you set your name in your account information.

to reproduce just set your name field to: </script><script>alert('xss')</script>

and most pages on your account you will show XSS.