I'm totally frustrated. I reported this using the procedure mentioned in the FAQ but the confirmation email sent me back to the original form.
There is XSS on every page of Stack Overflow. Injecting
,alert(1), into the path executes when clicking on the mobile version of the site.
Steps to reproduce:
- Click on the mobile link in the footer.
The mobile link is incorrectly escaped for the context the data is in.
<a onclick='StackExchange.switchMobile("on", "/",alert(1),"")'>mobile</a>
HTML entities will still break out of the string since the data is inside an attribute resulting in the function being called.