Helpy application versions 2.1.0 to 2.8.0 are vulnerable to Stored XSS in Delete user and Anonymize User functionalities. A low privileged user can inject JavaScript payload in the name field from his profile. When the admin visits the users page and takes an action to either delete the user or anonymize the user the payload gets loaded and triggers XSS by loading external JavaScript into the application.