## https://sploitus.com/exploit?id=WPEX-ID:278F7C36-05F8-4B6F-9A13-11175E3F3971
Set the payload below in the Username and API Key fields to the Wizard tab of the settings (wp-admin/options-general.php?page=async-javascript&tab=wizard)
" style=animation-name:rotation onanimationstart=alert(/XSS/)//
Then click on Processed to Step 2 (which generate an error about the Username and key being incorrect), and reload the age to trigger the XSS