REGEXSS Demo: How Hackers Exploit Regular Expressions in WordPress | Mat Rollings (Stealthcopter)

In this recorded episode of the Melapress Live Show, we're joined by Matthew Rollings, an Application Security Professional and bug bounty hunter, to explore a vulnerability class – RegexXSS.

Mat breaks down how developers inadvertently introduce cross-site scripting vulnerabilities by using regular expressions to manipulate sanitized HTML and why this subtle mistake has already earned him £20–30k in bug bounties across WordPress plugins.

We will cover:

- What RegexXSS is and why it's a distinct vulnerability class from standard XSS
- How WordPress's built-in sanitization can be bypassed through post-sanitization regex manipulation
- Why regex should never be used to parse or modify HTML, and what to use instead
- Real-world demo: how an attacker can exploit a regex-based deletion to inject a JavaScript payload
- The impact of XSS on WordPress admins, including silent admin account creation
- How Mat uses regex itself to hunt for RegexXSS vulnerabilities across 70,000+ WordPress plugins

This episode is for WordPress developers, plugin authors, and security-conscious site owners who want to understand a widely overlooked vulnerability class before attackers exploit it.

📒 Show notes links:
GitHub page with published reports and hacking plugin: https://github.com/stealthcopter/wordpress-hacking
WP Capture the Flag: https://wpctf.org

👤Learn more about Matthew Rollings:
LinkedIn profile: https://www.linkedin.com/in/mat-rollings
Website: https://sec.stealthcopter.com/

🎙️Learn more about the host:
Robert Abela: https://www.linkedin.com/in/robertabela/
Melapress website: https://melapress.com

Timestamps:
15:20 - What is Cross-site Scripting (XSS)?
18:41 - XSS Attack Demo
21:55 - What are Regular Expressions (Regex)?
30:00 - What is a REGEXSS vulnerability?
35:40 - REGEXSS exploitation demo
👍 Like, comment, and subscribe for weekly conversations on WordPress security, ethical hacking, and developer best practices.

#RegexXSS #XSS #CrossSiteScripting #Regex #RegularExpressions #BugBounty #WordPress #WordPressSecurity #WordPressPlugins

Видео REGEXSS Demo: How Hackers Exploit Regular Expressions in WordPress | Mat Rollings (Stealthcopter) канала Melapress