Crowdfund: Stored XSS in a comment field escalating to one-click admin takeover

Pool funds with other buyers to unlock this exploit together — once the target is reached, every contributor gets full access.