OroCRM Cross Site Scripting

`# Affected software: OroCRM is an easy-to-use, open source CRM with built in marketing automation tools for your commerce business. It's the CRM built for both sales and marketing!  
# Discovered by: Provensec  
# Website: http://www.provensec.com  
# Author: Provensec Labs  
# Type of vulnerability: XSS Stored  
# Description:  
  
1 Goto http://server add a new lead fill all the fields properly but Fill the email filed with xss payload as given in the screenshot  
http://prntscr.com/4lf043  
  
payload used "><img src=d onerror=confirm(/provensec/);>  
  
2 click save and close button  
  
http://prntscr.com/4lf0ej  
  
`