you cant send post parameters in a URL, those would be get parameters. Now if the field storage method also parsed get parameters I can see that being XSS, I d

you cant send post parameters in a URL, those would be get parameters. Now if the field storage method also parsed get parameters I can see that being XSS, I didn’t consider that. it’s definitely not being stored if it’s immediately printed like in the example , so that’s not a problem and you don’t need a browser exploit for XSS to be a problem on its own, I just wasn’t sure if that example counts.