Xero: Additonal stored XSS in Add note/Expected payment Date

When you make an invoice, the person you make the invoice out to can be an xss vector like " then fill out the rest of the invoice and create it. Go to the invoice then when you go the invoice and click add note/expected date it'll trigger...