Stored XSS
### Describe the bug

I found a Stored XSS on a page that can be publicly accessible to all visitors. But I didn't find a suitable place to report. 
Please guide me on this. 

### Steps to reproduce the bug

Due to security restrictions, I don't want to publish it publicly.

### Expected behavior

User inputs must be sanitized before rendering.

### Environment info

https://huggingface.co/ Web UI
Hi! You can contact `security@huggingface.co` to report this vulnerability.