WePay: Unauthenticated Stored XSS in API Panel

There is an unauthenticated stored XSS in the API Panel of the app administration e.g. https://stage.wepay.com/apps/manage/12873/apikeys When an user is created via the API, the call log does not sanitize the output correctly see screenshot 1. So it is possible to execute arbitrary scripts in the...