# Stored XSS in intensedebate.com via the Comments RSS

Blog post title reflected unencoded into IntenseDebate comments.rss XML, so a crafted title with namespaced script tag fires stored XSS on any user's profile feed.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: bugra
- Disclosed: 2022-11-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1664914
- Library page: https://bugbountylibrary.com/r/h1%3A1664914
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:xss

**Target:** comments.rss RSS/XML feed on intensedebate.com
**Root cause:** The blog post title is reflected into the RSS/XML output without HTML/XML encoding, allowing injected markup to be parsed as XML and execute.
**Steps:**
1. Install IntenseDebate on your own site
2. Create a blog post titled `<a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(document.domain)</a:script>`
3. Comment on that post with your IntenseDebate account
4. Visit `https://www.intensedebate.com/people/<user>/comments.rss`; XSS fires
**How found:** Noticed the blog post title was reflected into the comments.rss XML without encoding; hypothesized XML namespace trick (`a:script` with xhtml namespace) would execute, then tested on own IntenseDebate install.
**Exploitation:** Attacker controls a blog title, comments on their own post to populate their public comments.rss feed; any visitor loading that RSS URL executes the injected script in intensedebate.com origin.
**Insight:** RSS/XML feeds are a separate sink from HTML pages: test title/comment fields in .rss endpoints, and use XML namespace-prefixed script tags (`<a:script xmlns:a=...>`) to bypass naive HTML-only filters.