Lab: Stored XSS into anchor href attribute with double quotes HTML-encoded

Summary: PortSwigger's Web Security Academy lab describes a stored cross-site scripting vulnerability in a comment function, where the comment author's Website input is reflected inside an anchor href attribute with double quotes HTML-encoded. The solution is to submit the payload javascript:alert(1) in the Website field, then click the author name above the comment to trigger the alert.
What's compelling: The flaw lives in a link attribute rather than page body text, so a filter that only HTML-encodes quotes still lets a javascript: URL through - and the payload persists for every visitor who clicks the commenter's name.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026