Stored XSS in private message

Summary

We recently deployed changes to email previews in our Timeline feature, and @mosuan identified that the <iframe> used to display email contents was no longer sandboxed. This resulted in a stored XSS vulnerability. This was a valid XSS within the scope of our program because it executed outside of the rich text and theme editors on /admin of the store. It was awarded $1000 because exploitation would require access to a staff account with Customers permission.