However, just finding the function does not mean that you have found an XSS vulnerability. For the site to be vulnerable, you must somehow manage to pass user input (such as a query parameter, a form field, something you can get saved into the database...) into the function. If you manage to do that, you have found a "real" XSS vulnerability, and not just a "self" one.
If you can only get code to execute from the console, it's not a real PoC and I wouldn't bother reporting it to anyone. If you are writing in the console, you can already execute arbitrary code and you don't need the