Stored XSS on Comments

[down3rz]

The script i used was :

<a onmouseover=alert('XSS')>Click me</A>

I executed this script on comments and this showed up

Im sure this is severe and im waiting for the fix, thank you im not good in writing write-ups.

[down3rz]

i executed the script on my own blog

[ocean90]

Hello, when writing this ticket you should have seen this notice:

Do not report potential security vulnerabilities here.
See the ​Security FAQ and visit the ​WordPress HackerOne program.

Please also read ​Why are some users allowed to post unfiltered HTML?.