# WordPress core stored XSS via attachment file name

WordPress core fails to HTML-escape attachment file names, so a low-privileged author can inject script via XML-RPC wp.newPost and execute it in an admin's media list.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: jouko
- Disclosed: 2016-08-05
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/139245
- Library page: https://bugbountylibrary.com/r/h1%3A139245
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:php tech:wordpress technique:source-review vuln:xss

**Target:** wp-admin media list table and attachment page
**Root cause:** Attachment file names are echoed with wp_basename() without HTML escaping in class-wp-media-list-table.php and on the attachment page, so attacker-controlled filenames render as HTML.
**Steps:**
1. Create `xss.xml` calling `wp.newPost` with `post_type=attachment` and `file` set to `ccc'>test<img src=x onerror=alert('xss') onload=alert('xss')>`
2. Send it: `curl 'https://wordpress.site/xmlrpc.php' --data-binary "`cat xss.xml`" -H 'Content-type: application/xml'`
3. As administrator open Dashboard > Media in list mode; the alert fires
**How found:** Noticed missing HTML encoding of attachment file names, then grepped for places echoing the filename and found class-wp-media-list-table.php and the attachment page template.
**Exploitation:** An authenticated user with attachment-creation capability (e.g. via XML-RPC wp.newPost) sets a malicious filename; when an admin views the Media list or the attachment page, the unescaped filename executes script in the admin's session.
**Insight:** Attachment filenames are attacker-controlled via XML-RPC wp.newPost even when upload sanitization is bypassed; grep for wp_basename()/get_attached_file() echoes in admin templates and theme attachment pages for unescaped output.