TP-LINK official online store storage XSS

TP-LINK official online store storage type XSS a boring to visit TP-LINK to see the wood has a new product website have read the side found that the filter are filtered to see that the welcome behind is what we wrote at the Registration the account cannot be changed, I don't know if there is a wooden filter in this place. But if it is registered normally, the page will check whether the content in the box is swollen or not? Try to register and capture packets normally, and then change the packet and resend the packet to see if memberName = is our user name changed to our XSS statement, and then Replay sends the modified package. Oh, what is the situation?
No filtering amount =============================================================== imagine, now we replace the Xss statement with the cookie truncation statement xsser. the one in me. Then, when we leave a message at the product, will our user name be displayed? Executed? You can also buy something? Hmm? Is it executed? I cannot perform tests because I am not an administrator or the seller cannot review or view messages. If the above ideas come true, all these cookies will be handled, the back-end management of pai goes up, and the seller's account pai goes up, so it should be a little dangerous XSS vulnerability, right? PS: It feels a bit nonsense .......Solution:Check the content in the POST submission and filter the content