Description

Attackers can use this vulnerability to attack users/admins in the community, take over user/admins accounts, etc...

Proof of Concept

1、Register and log in as a user, add new questions and add tags

2、Insert the following payload in the tag description

<img src=x onerror=alert(localStorage.getItem('_a_lui_'))>

3、Post a question

4、When other users/admins view this tag

5、Trigger xss

https://www.dropbox.com/s/i9zrivadppckyo8/4.png?dl=0

Impact

Execute malicious js in the community, steal user tokens, etc...