A Post Title That Took Over Your Account
A post title got reflected into a script tag, which gave me stored XSS. From there I pulled the victim’s session token from an API endpoint and reset their password without the old one. One click, full account takeover.