Automattic · Report #81736

XSS in WordPress

Validstatus

4upvotes

16 Oct 2015disclosed

Summary

This potential XSS affects millions of WordPress users using Self-Hosted WP or either WP .

Hi there ,

I have identified a WordPress security vulnerability , a potential XSS vulnerability that affects latest version of WordPress .

POC :-

Go to GET *****.wordpress.com/wp-admin/post-new.php

In Text (HTML Field) input , <HTML xmlns: ><audio> <audio src=wp onerror=alert(0X1)>

Now, Click on Visual Tab , XSS will trigger . (Screenshot attached )

Thanks and please address this issue .

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original