# Stored XSS via LINK Name.

Stored XSS in Insightly marketing Link Name field breaks out of a script tag and executes in Email Templates page for all org users.

- Payout: hidden
- Severity: high
- Program: Insightly
- Found by: xploiterr
- Disclosed: 2025-09-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1392262
- Library page: https://bugbountylibrary.com/r/h1%3A1392262
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high technique:source-review vuln:xss

**Target:** marketing.na1.insightly.com Link Name / Email Templates page
**Root cause:** The Link Name value is embedded unescaped inside a <script> tag on the Templates page, allowing breakout via </script>.
**Steps:**
1. Log into https://marketing.na1.insightly.com/
2. Click Plus Sign -> Add a new redirect Link
3. Set Link Name to `'"></script><img src=x onerror=alert(1)>{{'7'*7}}` and fill other fields
4. Save, then go to Emails Icon -> Email Templates -> New Email Templates
5. Fill details and Save; XSS fires when the templates page renders
**How found:** Noticed Link Name reflected inside a <script> tag on the Templates page and tried breaking out with </script> plus an onerror handler.
**Exploitation:** Attacker stores the payload in a redirect Link Name; any org user visiting the Email Templates page executes arbitrary JS in the site context, enabling session theft or actions as the victim.
**Escalation:** Payload executes for all users in the organization visiting the templates page, widening impact beyond the attacker.
**Insight:** When a value is reflected inside a <script> block, try closing the tag with </script> rather than only escaping quotes; also probe template-rendering engines (the {{'7'*7}} marker) for secondary injection.