The Vulnerability Requires Immediate attention to mitigate the issue since admin account ,can be took over by eploiting this vulnerability by stealing the cookies and tokens.
Background:
Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application.
Stored XSS occurs when the user input is stored in the application and it gets executed every time any user triggers or vests the page.

The application has the functionality to change the survey admin email, where the logged in user can change the email.

Issue:
During the testing, I observed that the application does not validate the user-supplied input properly on the client and server side correctly however the application has the protection.

The "General Setting" functionality has the field "Administrator email address:" which allowed us to insert some of the special characters into its field. So by leveraging the issue we inserted malicious javascript payloads into the field, and it gets stored in the database. When the user save or reloads the page it gets executed.

For Instance, We were able to bypass the validation on both the client and server sides and injected the XSS payload in the field and it get executed upon saving and reloading the page.