Stored XSS on activity

How it was found

Hi security team members,

#Description I found a store xss on the activity which allows an attacker to steal admin account cookies.

#Step to reproduce 1-Create store 2- Add a member in a store 3- Member can choose any name 4- So change the any member name with hunter"><svg/onload=alert(2)> 5- Now on admain account make changes 6- That will create activity with attacker malicious payload

#POC Please see the below image {F329469} Let me know if more information is needed to my end. Best Regards, Shahzad

Impact

An attacker(staff member) can takeover admin account.