Loading HuntDB...

Stored XSS on wordpress.com

Medium
A
Automattic
Submitted None
Reported by riadalrashed

Vulnerability Details

Technical details and impact analysis

Cross-site Scripting (XSS) - Stored
## Summary: Hi team I found Stored XSS in wordpress.com via app.crowdsignal.com ## Platform(s) Affected: wordpress.com ## Steps To Reproduce: 1 . Go to https://app.crowdsignal.com/dashboard and create a poll 2 . Put the payload as answer <img src=x onerror=alert(document.cookie)> 3. Go to Share Your Poll and Copy the Website Popup 4.Go to https://wordpress.com/posts add new post 5. App Website Popup 6. Save it 7.Open the page and the XSS will fired █████████ ## Impact The attacker can use this issue to execute malicious script code in the victim user browser also redirect the victim user to malicious sites

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Cross-site Scripting (XSS) - Stored