[Security][High] XSS vulnerabilities in Wix integration examples via unsanitized innerHTML

[numbers-official]

Summary

The Wix integration example files contain XSS vulnerabilities through direct use of innerHTML with unsanitized attribute values. While these are example files (not production source), they serve as copy-paste templates for Wix integrators, propagating XSS vulnerabilities to downstream implementations.

Affected Files

examples/wix/capture-eye-element.js (line 5)

this.innerHTML = `<capture-eye nid="${nid}"><media-viewer src="${thumbnail}"/></capture-eye>`;

nid and thumbnail come directly from DOM attributes and are interpolated into HTML via template literals without sanitization.

examples/wix/capture-eye-sytle-element.js (lines 23, 32)

elem.innerHTML = `<capture-eye nid="${_nid}"><div class="container"><img src="${thumbnail}"...>${captureUpdatedDate}...${creator}...${headline}...`;

Multiple user-controlled values (_nid, thumbnail, captureUpdatedDate, creator, headline) are interpolated directly into HTML. Line 32 also has an inline onclick handler constructing a URL from _nid.

Impact

An attacker who controls these attribute values (e.g., via URL parameters passed to Wix custom elements) can inject arbitrary HTML and JavaScript. This affects any Wix site using these examples as templates.

Suggested Fix

Replace innerHTML usage with safe DOM construction:

• Use createElement + textContent for safe attribute assignment
• Use setAttribute instead of string interpolation for element attributes
• At minimum, add prominent security warnings in the example code and sanitize all interpolated values
• Consider providing a sanitization utility function in the examples

References

• OWASP XSS Prevention Cheat Sheet
• Related: [Security] Unvalidated API-sourced URLs in href attributes enable potential javascript: protocol XSS #77 (Unvalidated API-sourced URLs), [Security] XSS vulnerability in WordPress Elementor widget due to unescaped output #64 (XSS in WordPress Elementor widget)

Generated by Heart Beat with Omni