Shopify: Stored passive XSS at scheduled posts (kitcrm.com)

Hello! There is improper filtration of the website link field of scheduled post. Attacker can intercept the scheduled post creation/modifying request and change it content the following way: http POST /pages/175422/manualposts/31163 HTTP/1.1 Host: kitcrm.com...