Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is accessible by logged in users, where they can post certain personal resources that can be used only by themselves. It is not possible to share a resource to another user. Also, there is also a portfolio page, where you can make things public. I found two possible vulnerabilities, but I am asking to see if they are dangerous at all.
Stored XSS : The first vulnerability includes the resources page, where you can post a link. The first time you post the link, it is sanitized, and you cannot get anything useful through. Upon editing the link, though, it is not sanitized, and you can easily insert a <script>alert(1)</script>
or a <script>window.location.href="https://google.com"</script>
.
HTML Injection : On a different page called portfolio, a user can construct a portfolio and add resources. This page does not have the same XSS vulnerability as the previous page, and it is impossible to get javascript execution as far as I know. However, it is possible to insert an iframe into it. The iframe src cannot contain any javascript, but I can make the src lead to my resources page (where the stored xss vulnerability is located), to get javascript execution on the public profile page.
The Problem : The problem with this vulnerability, is that it only works when I view the portfolio page, because the resources page in the iframe is only accessible to me. The resource page link is possible to access using only one session cookie (my session cookie) when viewing it. Is there any way that I could pass my cookie into the iframe so that the xss vulnerability could be viewed on any user? Could I pass the cookie as a http header (there is a 'Set-Cookie' header). If I use an iframe, can the child access the parent's cookies? Is this even a vulnerability / can I make it work? Thanks so much!