Mixmax · Report #238906
Stored XSS in Templates>Enahance>Social Badges
Validstatus
7upvotes
16 Jun 2017disclosed
How it was found
Hi, just like the report #237927, I found stored XSS in Templates>Enhance> Social Badges section.
- Go to templates section and click on one of your templates.
- Enhance> Social Badges.
- Enter the payload: javascript:alert(1) in any of the social networking button url.
- You'll see that the xss is being triggered.
Note: The similar social sections in Call to Action button are not accepting this payload, so but this is not fixed in Social Badges section.
Thanks.