Exploiting XSS in POST requests
Summary: PortSwigger Research addresses whether a reflected cross-site scripting bug triggerable only via a POST request can be exploited, and the answer given is yes. The described mechanism is an attacker-built page holding an HTML form with the required fields plus a script that auto-submits it, or the same injection planted in a third-party application through a stored XSS bug, with the form submitted cross-domain as in a cross-site request forgery attack and the payload executing in the vulnerable application's security context.
Bottom line: Teams that treat reflected XSS as a GET-only problem leave POST-only endpoints exploitable through a form the victim never has to click, and the payload then runs with the full range of standard XSS attack actions inside the vulnerable application.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026