Description

I tested the demo site you provided and I see that there is a stored XSS in function Add discussion

Proof of Concept

payload: thanh"><script>alert(1)</script>

# Steps

1. Login as any user
2. In the Unassigned section and click view
3. In the Workflow click Copyediting section and Add discussion
4. Insert payload to Subject and save it
5. Click to name => detected XSS

video PoC: https://drive.google.com/file/d/1nsybTloKxd45a716hVFNOyxTrW4fbkry/view?usp=sharing