# [mercantile.wordpress.org] Reflected XSS

Angular template injection on mercantile.wordpress.org search and checkout endpoints bypassed a prior fix, executing reflected XSS via constructor.constructor payloads.

- Payout: hidden
- Severity: medium
- Program: WordPress
- Found by: zeeshank
- Disclosed: 2018-08-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/240256
- Library page: https://bugbountylibrary.com/r/h1%3A240256
- Tags: area:web domain:web kind:bounty platform:hackerone sev:medium technique:incomplete-fix technique:source-review vuln:xss

**Target:** Angular-rendered search (?s=) and checkout discount-code input
**Root cause:** User input was interpolated into Angular templates, and the prior fix (#230234) was bypassed using HTML-entity-encoded braces plus constructor.constructor to escape the expression sandbox.
**Steps:**
1. Visit `https://mercantile.wordpress.org/?s=%26%23123%3B%26%23123%3Bconstructor.constructor%28%27alert%28document.domain%29%27%29%28%29%7D%7D&post_type=product`
2. Observe alert(document.domain) firing from the reflected Angular expression
3. On `/checkout/`, enter `{{constructor.constructor('alert(document.domain)')()}}` in the discount code field
4. Observe XSS execution
**How found:** Researcher revisited the previously patched XSS (#230234) and tried HTML-entity-encoded braces to slip past the filter, then used constructor.constructor to break out of the Angular expression sandbox; later found the same pattern in the checkout discount-code field.
**Exploitation:** Attacker crafts a URL (or discount code) containing an Angular expression that decodes to `{{constructor.constructor('alert(document.domain)')()}}`, which Angular evaluates, executing arbitrary JS in the victim's session on the WordPress domain.
**Insight:** When an Angular app patches template injection by filtering `{{`, try HTML-entity-encoded braces (`{{`) and `constructor.constructor` to escape the expression sandbox; also check every user-input sink (search, coupon fields) for the same interpolation.