Stored XSS in Question edit for product name (bypass #1416672)

How it was found

Hi @judgeme! Step to reproduce:

1. Log in to your shopify account and create product with name "><"><img src=x onerror=prompt(document.domain)> img src=x onerror=prompt(document.domain)>
2. Go to our store and write question to our product with name "><"><img src=x onerror=prompt(document.domain)> img src=x onerror=prompt(document.domain)>
3. Then delete our product from store (The product status must be (out of store) in questions.
4. Then go to Shopify admin/Judge.me Product Reviews/Questions and edit question. XSS triage

{F1547145}

POC video

{F1547181}

Impact

session stealer