# Lazy Load stored XSS

Lazy Load plugin's img-src regex mishandles spaces and mixed quotes, letting low-privileged authors inject onerror JS that runs in an admin's browser.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: jouko
- Disclosed: 2017-12-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/152416
- Library page: https://bugbountylibrary.com/r/h1%3A152416
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:source-review vuln:xss

**Target:** WordPress plugin content filter (preg_replace on img tags)
**Root cause:** The regex `#<img([^>]+?)src=[\'"]?([^\'"\s>]+)[\'"]?([^>]*)>#` fails to properly delimit the src attribute when spaces or mixed single/double quotes appear, so attacker-controlled text after src is treated as new HTML attributes.
**Steps:**
1. Craft post content: `<img src="/foo onerror=alert(/xss/) // " />`
2. The regex captures `src` value and re-emits the tag with `data-lazy-src` and a noscript fallback, but the malformed quoting lets `onerror=alert(/xss/)` survive as a real attribute
3. Save/publish the post as a low-privileged author
4. When an administrator views the post, the injected onerror JavaScript executes in the admin's session
**How found:** Noticed the plugin's 'pretty simple regex' for rewriting img tags and tested malformed img markup with spaces and mixed quotes to see if attribute boundaries could be broken.
**Exploitation:** A low-privilege user publishes a post containing the crafted img tag; the plugin's content filter rewrites it into markup where the injected onerror attribute is preserved, so the JS fires in the browser of any admin who views the post, enabling admin actions like password changes, user creation, or plugin PHP edits.
**Escalation:** Stored XSS in admin context escalates a low-privileged author to full administrative control / potential server compromise.
**Insight:** When a filter rewrites HTML with a regex that assumes well-formed quoting, test src/href values containing spaces and mismatched single/double quotes to break out of the attribute and inject event handlers.