Stored XSS in Discounts section

Summary

We recently deployed changes to our discount timelines and @mosuan identified that product names were no longer being properly escaped. This resulted in a stored XSS vulnerability when a product with an XSS payload was referenced in the comments for a discount code. This was a valid XSS within the scope of our program because it executed outside of the rich text and theme editors on /admin of the store. It was awarded $1000 because exploitation would require access to a staff account with discounts permission.