# Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass

Stored XSS in CrowdSignal survey question media embed: dailymotion shortcode parameter accepts an SVG onload payload, executing on page refresh.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: ali
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/974271
- Library page: https://bugbountylibrary.com/r/h1%3A974271
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:rest technique:source-review vuln:xss

**Target:** app.crowdsignal.com survey question media embed (media[] parameter)
**Root cause:** The media[11111111] parameter reflecting the dailymotion shortcode is stored and rendered without sanitizing the closing quote/attribute context, allowing an injected SVG onload handler.
**Steps:**
1. Create a survey at `https://app.crowdsignal.com/dashboard`
2. Open `https://app.crowdsignal.com/quizzes/{survey-id}/question` and add a Multiple Choice question
3. Click Add media > Embed Media and insert `[dailymotion id=x8oma9]`
4. Intercept Save in Burp and replace `media[11111111]` with `[dailymotion id=x8oma9"><svg/onload=prompt(document.domain)>]`
5. Forward and refresh the page to trigger the alert
**How found:** Researcher tested the dailymotion shortcode embed, then broke out of the attribute with `">` and injected an SVG onload handler in the media parameter.
**Exploitation:** Attacker with a Team plan survey invites victims to the dashboard; the stored payload executes in the victim's session on page load, enabling cookie theft.
**Escalation:** Team plan allows inviting other users to the dashboard, turning self-XSS into stored XSS against other users.
**Insight:** Shortcode-style media embeds that re-render stored parameters are prime attribute-breakout targets; test closing-quote injection inside the shortcode id value, not just the visible field.