I am making a store, where I want to allow the users to upload a custom html/js/css website to display with their product.
What security issues should I look for?
The two biggest issues surrounding DHTML are:
CSS files are safe
.html and .js files are NOT safe. You can make .html files safe by insisting on your own Content-Security-Policy: shutting down inline scripts and styles, and only allowing them to use libraries that you've vetted. .js files need to be personally inspected to ensure that they are safe.
My advice is that instead of letting them update the html and js files, it would be safer to provide a template that they could file out online, and whose content you could store in a database.