# Authenticated Cross-site Scripting in Template Name

Authenticated attacker with theme-editor access stores a Template Name comment containing script, which executes unescaped in wp-admin/theme-editor.php.

- Payout: hidden
- Severity: medium
- Program: WordPress
- Found by: zurke
- Disclosed: 2017-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/220903
- Library page: https://bugbountylibrary.com/r/h1%3A220903
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:xss

**Target:** wp-admin/theme-editor.php theme file editor
**Root cause:** get_file_description() returns the template name from the file's `Template Name:` comment, and theme-editor.php echoes $file_description/$description into the page without htmlspecialchars(), so HTML/JS in the comment is rendered.
**Steps:**
1. Go to Appearance > Editor.
2. Select a file without an existing display name (e.g. back-compat.php).
3. Add at the top of the file: `/* Template Name: <script>confirm(document.cookie);</script> */`
4. Click Update File.
5. XSS popup executes in the admin page.
**How found:** Source review of wp-admin/theme-editor.php noticed $file_description from get_file_description() is echoed into <li><a> without escaping, and that the active file's description is also displayed.
**Exploitation:** An authenticated user who can edit theme files stores a malicious Template Name comment; when the victim (admin) views or clicks the file in the theme editor, the unescaped name is echoed and the script runs in wp-admin context, exposing cookies.
**Insight:** Template Name (and other file-header) comments are parsed into display strings; check every admin UI that renders get_file_description() output, not just the file list, since the active-file description path is a second sink.