---
id: 5545
title: "XSS in hidden input fields"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/xss-in-hidden-input-fields"
published_at: "2019-06-14T12:03:00Z"
tags: ["firefox", "web-security", "xss", "hidden-input", "access-keys"]
phying_url: "https://phying.com/item/5545"
lang: en
---

# XSS in hidden input fields

## Summary

Gareth Heyes shows how to execute XSS inside hidden input fields: Firefox fires onclick when an access key activates the element. Includes the PoC vector and key combinations.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-06-14T12:03:00Z
- **Original:** https://portswigger.net/research/xss-in-hidden-input-fields
- **Phying News:** https://phying.com/item/5545