In this live bug bounty session, I demonstrate a **Stored Cross-Site Scripting (XSS) vulnerability in Wix** involving an event description URL field.

Initially, when I tried entering `javascript:alert(1)` directly into the URL field through the Wix website, the application rejected the input. To investigate the validation behavior, I tested the request using Burp Suite Repeater and modified the URL value to `javascript:alert(1)` before forwarding the request.

Although the modified value was accepted by the server, the alert did not execute immediately on the website.

Next, I tested the same behavior in the Wix Android application. The application also rejected the JavaScript URL when entered directly through its interface. However, after modifying the request through Burp Suite Repeater and forwarding it, the value was accepted and the JavaScript alert executed inside the Android app.

When I returned to the website and clicked the affected link, the alert also executed there, demonstrating the potential for stored XSS across the web and mobile application experience.

This demonstration highlights why input validation should be consistently enforced across different clients and why accepting a modified request does not, by itself, prove exploitability. The final impact depends on how the stored value is rendered and handled by each application.

**What you’ll learn:**
– How stored XSS can occur through URL fields
– How to inspect and modify HTTP requests with Burp Suite Repeater
– How web and Android applications may handle the same input differently
– Why server-side validation and safe URL handling matter
– How to verify whether a suspected XSS issue actually executes

**Disclaimer:**
This video is intended for educational purposes and authorized security testing only. All testing should be performed within the scope of an approved bug bounty program or on systems you own or have explicit permission to test. Do not use these techniques against unauthorized targets. Always follow the program’s rules and responsible disclosure guidelines.

#Wix #StoredXSS #BugBounty #XSS #BurpSuite #EthicalHacking #CyberSecurity #AndroidSecurity #WebSecurity #BugBountyHunting #XSSBypass #LiveHacking