Nothing new here though, I don't know how this is any different than any other `stored` XSS vulnerability.

E.g. You can inject syslog messages with XSS exploit and when admin looks at them within a browser you get credentials (if not properly sanitized). This is no rocket science, I see this everyday :-(