I have been able to inject an onerror event to the HTML.

In the image you can see onerror has been injected, but it never fires.

enter image description here

  • Does it work if you change the src to an invalid url? – Purefan Aug 26 '15 at 7:25

Judging by how alert(1);" onerror="alert(1); in the src attribute value got underlined I can guess that this is what you injected and that it is parsed as a string (you did not break out of tag value quotes). So there is probably no onerror attribute either, only value of alert(1);" onerror="alert(1); for data-mce-src attribute. To make sure, inspect the source code your browser receives, not some formatted dom representation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.