## https://sploitus.com/exploit?id=WPEX-ID:FDBEB137-B404-46C7-85FB-394A3BDAC388
1. Create a custom field for WordPress users which allows to store HTML
control characters. This can be done, e.g., with the "Advanced Custom
Fields" plugin [2].
2. Store "<img src=0 onerror=alert()>" in the custom field for any user.
3. Open the Admin Columns plugin settings.
4. Choose the "Admin Columns" tab and select "Users" from the drop down
menu.
5. Click "Add Column", choose the type "Custom Field" and select the
previously created custom field.
6. Open the user list in the WordPress backend. The JavaScript code will
be executed.