Stored XSS in /admin/product and /admin/collections