Stored XSS on wordpress.com

How it was found

Summary:

Hi team

I found Stored XSS in wordpress.com via app.crowdsignal.com

Platform(s) Affected:

wordpress.com

Steps To Reproduce:

1 . Go to https://app.crowdsignal.com/dashboard and create a poll 2 . Put the payload as answer <img src=x onerror=alert(document.cookie)> 3. Go to Share Your Poll and Copy the Website Popup 4.Go to https://wordpress.com/posts add new post 5. App Website Popup 6. Save it 7.Open the page and the XSS will fired

█████████

Impact

The attacker can use this issue to execute malicious script code in the victim user browser also redirect the victim user to malicious sites