Stored Xss On "https://www.question.com/"

How it was found

Hi Team I'm Find the Stored Xss On your Site

Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application.

Steps To Reproduce:

1. Go To Your Site https://www.question.com/
2. Nave https://www.question.com/ask/
3. Ask a Question Enter the Payload <iframe onload=alert(document.domail)>
4. Click to Sumit Question & Redirect to https://www.question.com/iframe-onload-alert-9-1631390.html
5. XSS was Tigred you See the Popup

POC

████

Tested on Firefox and chrome.

Impact

The attacker can steal data from whoever checks the report.