🎯 New Report #3931771: Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get media item()`
🔺Severity: Critical
👽 Reporter: jakubk
⭐️ Reputation: 222
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-08-11
⏰ Disclosed: 2026-08-28 16:38:57
📝 Summary: A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.
📂 Report JSON File: 3931771
@hackeronereports