Post cover image

July 27, 2026

How I Found a Reflected XSS and Bypassed Wordfence WAF

Hello everyone,

By elko0k

1 min read

I'm kerlous nasser (elko0k), in this article i will explain how i discovered a reflected xss and bypassed wordfence WAF.

Details

while exploring a bugcrowd target, i found a subdomain that contained a search bar. i first checked the technologies used with the wappalyzer extension and found that the site was running WordPress.

without expecting much, i entered the following payload into the search box:

www.redacted.com?s=keroxss<>"'

unexpectedly, the input was reflect back into the page with unusual behavior:

<input type="text" value="keroxss\" \'"="" name="search-terms" id="search" required="" placeholder="Search">

my payload breaks out the HTML attribute context.

now it's time to inject an event handler that would make alert. i try the following payload:

www.redacted.com?s="+onfocus=alert(1)

unfortunately, the request was blocked by the WAF. after identifying the WAF as wordfence, i suspected it relied on a blocklist.

so, i sent the request to Burpsuite intruder, used list of event handlers from portswigger, and began fuzzing different event names. none of them worked.

i then started search for wordfence bypasses and tried numerous techniques, but nothing succeeded.

during my testing, i noticed something interesting:

< was encoded as < , ", ' were not encoded

then i got idea to close the input element but what's next, the server encode the open tags < so, it is impossible to to inject for example

i spent several hours trying different payloads without success.

giving up? no, i took a break then come back

i started reviewing all of my previous requests in burpsuite. i found something i didn't notice it at the first. the server was removing <> whenever the two characters appeared together.

so what if i enter the same payload above but insert <> inside event handler to trick the WAF and the server remove <> then the result will be what i want.

i tested new payload:

www.redacted.com?s="+on<>focus=alert(1)>

and guess what? it works 💥

<input type="text" value="\" onfocus="alert(1)">
None

and that how i get advantage from filtering logic in the server to bypass WAF and get XSS.

i make some changes in the payload to increase the impact. i add autofocus attribute to trigger the xss without any click and chaining it with cors to return senistive data and send it to external server.

I reported it but saddly it is duplicate 🥲

None