---
id: 5480
title: "Finding DOM Polyglot XSS in PayPal the Easy Way"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/finding-dom-polyglot-xss-in-paypal-the-easy-way"
published_at: "2022-09-07T09:04:00Z"
tags: ["bug-bounty", "dom-invader", "dom-xss", "csp-bypass", "paypal", "script-gadgets"]
phying_url: "https://phying.com/item/5480"
lang: en
---

# Finding DOM Polyglot XSS in PayPal the Easy Way

## Summary

Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-09-07T09:04:00Z
- **Original:** https://portswigger.net/research/finding-dom-polyglot-xss-in-paypal-the-easy-way
- **Phying News:** https://phying.com/item/5480