wix-headless-templates

This component renders FAQ data and has a potentially serious XSS sink because q.answerHtml is inserted with dangerouslySetInnerHTML without visible sanitization; the actual risk depends on whether useFaq or another upstream layer sanitizes the content. No malware behavior or data exfiltration is evident in the supplied fragment. Severity is conditional on the trust and sanitization of FAQ answer content.

This module implements Wix token management and authenticated API requests. The main security concern is that wixRequest accepts an unrestricted path and sends the access token to the resulting URL, so a caller-controlled absolute URL could exfiltrate that token; tokens are also persisted in localStorage. No evidence of intentional malware or obfuscation is present. Severity is moderate and depends on whether untrusted input can control path.