Stored XSS Vulnerability

Do I report details here? Do you issue CVE's?

You will find details on how to report in the README.md file. I don't believe OpenCart have ever issued a CVE.
https://github.com/opencart/opencart/bl ... 20location.

If you would like to report a serious security bug please PM an OpenCart moderator/administrator on the forum. Please do not report concept/ideas/unproven security flaws - all security reports are taken seriously but you must include the EXACT details steps to reproduce it. Please DO NOT post security flaws in a public location.

Although in my experience they don't always respond. Perhaps one of the forum moderators could advise which moderator/administrator is best to PM.

I would also check the GitHub issues, it may already be posted and will give you an idea of the kind of response you might get.
https://github.com/search?q=repo%3Aopen ... ype=issues