Steps To Reproduce:

1. 1. Navigate to the campaigns section
2. 2. Click on "Create a ongoing campaign"
3. 3. Fill title, message, inbox and URL
4. 4. Then click on "Create" and intercept it
5. 5. Change your url's value to javascript:alert(1) (for example "url" : "https://google.com" to "url" : "javascript:alert(1)"
6. 6. Sent the request
7. 7. We can see in column "URL" , link javascript:alert(1)
8. 8. If user clicks on it, an XSS will be triggered
9. 9. It works only in FireFox and Safari

Impact

Attacker can convinces a victim to visit a URL then he can:

1. 1. Steal users cookies
2. 2. Redirect the user to malicious website