Lab: Stored XSS into HTML context with nothing encoded
Summary: PortSwigger's Web Security Academy lab describes a stored cross-site scripting vulnerability in a blog's comment functionality, where the comment field stores input without encoding it into the HTML context. The solution is to submit <script>alert(1)</script> as a comment, fill in a name, email and website, post it, and revisit the blog post to trigger the alert.
Bottom line: A comment box that stores raw HTML and runs it for every later visitor turns one submitted comment into script execution in other users' browsers - the lab's entire payload is a single unencoded script tag.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026