Stored XSS against all Chaturbate users using an application name

Summary

The hacker discovered that the tooltip on the app page did not protect against XSS attack in the application name. We quickly resolved this issue. The impact for a new attacker was limited as they would only appear under new apps.

This vulnerability was discovered using a simple XSS payload in the app name, however it only popped up on /apps/ where all the applications are listed.