CSS Injection in My Own Theme Preview: A Visual Integrity Crisis
A local theme preview accepted a color value that changed the local theme preview.
Executive summary
During routine testing of a theme customization interface, I discovered that a user-controlled color setting affected the rendering of that same user’s preview. The application allowed me to change the background color to orange.
Reproduction
In an isolated local HTML page, the CSS custom property below changes the preview background. This demonstrates user-controlled styling, not cross-user injection or script execution.
<div style="--preview-color: #ff8c00; background: var(--preview-color); padding: 1rem;">
Preview: orange, as configured by the user.
</div>Scope of impact
The effect was confined to my own preview and did not persist to other users. I found no evidence of data exposure, privilege escalation, or security-boundary crossing.
Impact assessment
Visual consistency is central to user trust. A sufficiently unexpected shade of orange could, in theory, undermine brand confidence. I therefore requested critical severity.
Vendor response
The vendor explained that changing the theme color was the intended function of the theme editor. I have requested escalation to someone with a broader understanding of visual integrity.
$12,000 requested · $0 awarded · orange confirmed
This is fictional cybersecurity satire. No real vendor, vulnerability, or payment demand is implied.