Reflected XSS via wrong permission check in conversion statistics

Summary

Description

HackerOne community member Patrick Lang (7YR) has reported a reflected XSS vulnerability in the conversion-statistics pages. An incorrect ownership check used the advertiser identifier in place of the website identifier, allowing crafted website input to reach the page output. An attacker can send a crafted URL to an authenticated user and execute JavaScript in that user's browser. A related hour-parameter output issue is addressed by the same fix.

Resolution

Website ownership checks now validate the correct identifier, and the hour parameter is normalised to an integer before formatting.

Security advisory

https://www.revive-adserver.com/security/revive-sa-2026-004