Nimbus settings. The change-notification-email action is CSRF-protected: it requires a per-session token that is rendered into this page's DOM. A cross-site page can't read that token - but a same-origin script can. This greeting reflects the name query param without encoding it. Land an XSS here, read the token out of the DOM, and forge the change.
Prove the reflected XSS with the in-app callback, e.g. set ?name= to <img src=x onerror="fetch('/m10-p/naked/xss-steals-csrf-token/api/solve').then(r=>r.text()).then(t=>{var f=document.forms[0];f.email.value='attacker@evil.com';f.submit();})">. The callback confirms execution and hands back the CSRF token; the same script then reads #csrf and submits the protected form.