# [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection

AngularJS template injection in the WordPress Swag Store search endpoint let a crafted {{constructor.constructor(...)}} payload execute reflected XSS in the page title.

- Payout: hidden
- Severity: medium
- Program: WordPress
- Found by: ysx
- Disclosed: 2017-06-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/230234
- Library page: https://bugbountylibrary.com/r/h1%3A230234
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** search endpoint of mercantile.wordpress.org
**Root cause:** The search query is reflected into the page title, which AngularJS compiles as a template, so attacker-controlled expressions are evaluated.
**Steps:**
1. Request `https://mercantile.wordpress.org/search/{{2*2}}` and observe `4` reflected in the site title, confirming AngularJS template evaluation.
2. Send `https://mercantile.wordpress.org/search/{{constructor.constructor('alert(document.domain)')()}}` to execute JavaScript in the victim's browser.
**How found:** Noticed that a search query for `{{2*2}}` returned `4` in the site title response, indicating AngularJS was compiling the reflected input as a template.
**Exploitation:** A victim visiting the crafted search URL has the AngularJS expression evaluated in the page title context, executing arbitrary JavaScript in the mercantile.wordpress.org origin.
**Insight:** When reflected input lands in a page title, test AngularJS expression evaluation with `{{2*2}}`; a numeric result confirms client-side template injection that bypasses normal HTML-encoding defenses.