xh.js PostMessage XSS PoC

Domain x-visualxh.site passes the substring trust check because "visualxh.site" appears on the trusted origins list.

Steps:

1. Click Open Target Page to launch an xhamster tab (with xh.js active).
2. Wait for it to load, then click Trigger XSS via openUrl.

Open Target Page (xhamster) Trigger XSS via openUrl

Generated Code: