# Stored XSS vulnerability in comments on *.wordpress.com

SyntaxHighlighter auto-linker in wordpress.com comments accepts javascript:// URLs, letting a commenter store a clickable XSS payload executing in the site's origin.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: poutine_hero
- Disclosed: 2019-10-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/707720
- Library page: https://bugbountylibrary.com/r/h1%3A707720
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:wordpress technique:source-review vuln:xss

**Target:** SyntaxHighlighter plugin comment rendering on *.wordpress.com
**Root cause:** The URL auto-link regex `\w+:\/\/[...]` accepts any word-character scheme, including `javascript:`, so code blocks render attacker-controlled pseudo-protocol links.
**Steps:**
1. Post comment containing `[code]javascript://%0dalert%28document.cookie%29[/code]` on a *.wordpress.com site
2. Rendered highlighted code auto-links the `javascript://` portion
3. Victim clicks the link, executing JS in the site origin
**How found:** Noticed the bundled SyntaxHighlighter regex `\w+:\/\/` was looser than the upstream version and allowed arbitrary schemes; hypothesized javascript: would be auto-linked and tested with a comment payload.
**Exploitation:** Attacker submits the crafted comment; any visitor who clicks the rendered javascript: link runs attacker JS with the victim's session on the wordpress.com subdomain.
**Insight:** When a code highlighter auto-links URLs, its scheme regex is an XSS sink; compare bundled plugin regexes against upstream and test non-http schemes like javascript: inside code blocks.