# Follow Button XSS

Reflected XSS in WordPress.com Follow action bar: unsanitized referer/subscribeNonce injected into HTML, triggered when logged-out user clicks Follow.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: bobrov
- Disclosed: 2016-10-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/172574
- Library page: https://bugbountylibrary.com/r/h1%3A172574
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:wordpress technique:source-review vuln:xss

**Target:** apps.wordpress.com action bar / s2.wp.com static JS
**Root cause:** The actionbar data object embeds the page referer and subscribeNonce into a JS string without escaping, and showActionBarFollowForm concatenates fbd.referer and fbd.subscribeNonce into HTML via .html(), so attacker-controlled URL path breaks out into script tags.
**Steps:**
1. Craft URL `https://apps.wordpress.com/support/"><script>alert(document.domain)</script>`
2. Ensure fbd.isLoggedIn is false (logged out)
3. Open the link and click "Follow" in the bottom-right action bar
4. The referer value is concatenated into the follow form HTML and the injected script executes
**How found:** Noticed the actionbar data object reflected the URL path into referer and subscribeNonce fields, then traced showActionBarFollowForm building HTML via string concatenation with .html().
**Exploitation:** Victim opens crafted apps.wordpress.com URL while logged out; clicking Follow renders the follow bubble HTML containing the unescaped referer, executing attacker script in the wordpress.com origin.
**Insight:** Action-bar/bubble widgets that build forms via jQuery .html() string concatenation from server-embedded JSON (referer, nonce) are prime reflected-XSS sinks; check logged-out code paths that differ from logged-in ones.