stored xss in app.lemlist.com

How it was found

Hi there, I found a stored xss app.lemlist.com.

Steps To Reproduce:

1. go to https://app.lemlist.com/.
2. create or edit campaigns.
3. visit tab Buddies-to-Be.
4. click Add one on the right Top.
5. Fill in the input
6. add /><svg src=x onload=confirm(document.domain);> ** Icebreaker** and companyName
7. click create .

POC

{F901411}

Impact

Stealing cookies