Hi,

There is a stored XSS caused be the conversion of a blog post's contents from the classic editor to the new editor. When clicking the button to switch to the new editor, the code at editor.rs (

) uses the WebAssembly-JS bridge to run content.set_inner_html(&content_val); using the post's text. If the text contains HTML tags like <img src=x onerror=alert()>, an XSS will occur.

1. In a Plume instance, create a post draft in a blog using the classic editor with the contents <img src=x onerror=alert()>.
2. Autosave.
3. Switch to the new editor. An alert box will pop.

To fix this, you should use content.set_inner_text(&content_val); instead.

• Plume version: 0.7.2
• Operating system:
• Web Browser: Safari