Reflected XSS in search parameter chains to one-click account takeover

Summary

The search functionality of a public photo library reflected the s query parameter into six locations in the HTML response. Five applied proper HTML entity encoding. The sixth, a page heading rendered inside an <h1> element, reflected user input with no HTML encoding. The only transformation applied was backslash-escaping of quotes, which has no sanitisation effect in an HTML element context.

The application ran WordPress with MemberPress for account management. The password-change form at /account/?action=newpassword required only a WordPress nonce readable from the same origin — not the current password. This allowed the reflected XSS to chain into a silent, one-click account takeover: a single crafted link, clicked by a signed-in user, changed their password to an attacker-controlled value with no further interaction.

Contributing factors

• No Content-Security-Policy header — inline scripts, event handlers and external script loading were unrestricted.
• WordPress wordpress_logged_in_* cookies were not HttpOnly, enabling direct session theft as an alternative to the password-change chain.
• The password-change form required no reauthentication, making a silent one-click takeover possible rather than requiring the attacker to use a stolen session interactively.

Timeline

• 18 Aug 2026 · ReportedSubmitted through the vendor’s vulnerability disclosure program.
• 14 Sep 2026 · TriagedConfirmed reproducible. Severity assessed at CVSS 8.1 High. Forwarded to the vendor.
• 15 Sep 2026 · AcknowledgedVendor confirmed receipt and began processing.
• 01 Oct 2026 · FixedVendor deployed the fix. We verified the reflected XSS no longer reproduces and the account-takeover chain is broken at its entry point.

Verification

On the patched build, the search parameter is HTML-entity encoded in the <h1> heading, matching the encoding already applied at the other five reflection points. The injected markup renders as visible text rather than being parsed as HTML.

Credit

Reported by Merrick Hare, Enterprise Hare LLC. The full technical write-up is published at merrickhare.com.

No proof-of-concept code is published. The vendor has remediated the issue.