An authenticated attacker is able to create alerts that trigger a stored XSS attack.
osnexus quantastor