# Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media

Stored XSS in CrowdSignal quiz answer media embed via [wpvideo] shortcode parameter, executing on app.crowdsignal.com and survey.fm subdomains.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: ali
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/920005
- Library page: https://bugbountylibrary.com/r/h1%3A920005
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:xss

**Target:** quiz question media embed (media[] parameter) on app.crowdsignal.com and survey.fm
**Root cause:** The media embed parameter accepts a [wpvideo ...] shortcode whose argument is not sanitized, allowing attribute-breaking characters and an injected SVG onload handler to be stored and rendered.
**Steps:**
1. Create a quiz at `https://app.crowdsignal.com/dashboard`
2. Open `https://app.crowdsignal.com/quizzes/{quiz-id}/question` and add a Multiple Choice question
3. Click Add media, select Embed Media, insert `[wpvideo w0MiG12E]`
4. Intercept Save in Burp and replace `media[23168664]` with `[wpvideo%20w0MiG12Exx1\"><svg/onload=prompt(document.domain)>]`
5. Forward, refresh page to trigger XSS
6. Visit `https://app.crowdsignal.com/sharing/quiz/{quiz-id}/` survey.fm link to trigger XSS there too
**How found:** Researcher noticed the Embed Media feature accepts a WordPress `[wpvideo]` shortcode and tested breaking out of its argument with quote characters to inject an SVG onload handler.
**Exploitation:** Attacker stores the payload in a quiz answer's media field; any viewer of the quiz or its public survey.fm share link executes the script in the CrowdSignal/survey.fm origin, enabling cookie theft.
**Insight:** Shortcode-style embed fields (e.g. `[wpvideo id]`) that pass user input into HTML attributes are prime breakout targets; try closing the attribute with `">` and appending an event-handler tag, and check whether the same stored value renders on secondary share/preview domains.