# [public-api.wordpress.com] Stored XSS via Crafted Developer App Description

Stored XSS in a WordPress.com developer app's Description field executes on the public-api.wordpress.com OAuth authorize page when a victim opens the crafted link.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: ysx
- Disclosed: 2017-12-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/293743
- Library page: https://bugbountylibrary.com/r/h1%3A293743
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:oauth technique:source-review vuln:xss

**Target:** public-api.wordpress.com OAuth2 authorize endpoint rendering developer app description
**Root cause:** The developer app Description field is stored unsanitized and rendered into the OAuth authorize page HTML without encoding, allowing HTML/JS injection.
**Steps:**
1. Create a new app at developer.wordpress.com/apps, set Name/Website URL generically and Redirect URL to `https://google.com`.
2. Put the payload `'"><div id="test"><head><base href="javascript://"/></head><body><a href="/. /, /' onmouseover=confirm(document.domain); abc=abc">TESTLINK` into the Description field, save, note client ID.
3. Visit `https://public-api.wordpress.com/oauth2/authorize?client_id=YourID&redirect_uri=https://google.com&response_type=code&blog=`.
4. Mouse over the `TESTLINK` text to trigger `onmouseover` and execute JS.
**How found:** Researcher tested the app Description field for injection and found it reflected unsanitized into the OAuth authorize page, then crafted a payload using a base tag and onmouseover handler to bypass filtering.
**Exploitation:** Attacker stores the payload in their app description, then sends the crafted OAuth authorize URL to a WordPress.com user; hovering TESTLINK executes arbitrary JS in the public-api.wordpress.com context within the victim's session.
**Insight:** OAuth authorize pages render attacker-controlled app metadata (name, description, logo) — test these fields for stored XSS since they are shown to any user who clicks an authorize link, giving session-context execution.