How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

XSS (Cross Site Scripting) Part 1 – What is XSS? – simpleisbest.co.uk

Securin (previously CSW) Discovers Stored Cross-Site Scripting

How hackers exploit XSS vulnerabilities to create admin accounts

WordPress XSS Protection: Safeguard Your Site In 2023

XSS to RCE – using WordPress as an example

Securin (previously CSW) Discovers Stored Cross-Site Scripting

TrustedSec Tricks for Weaponizing XSS

53973 (WordPress <= 5.8 - Authenticated Persistent XSS (User role

Over 2 million Websites Vulnerable to XSS Exploit (CVE-2023-30777

The impact of an XSS vulnerability on WordPress: How hackers

XSS to RCE – using WordPress as an example

WordPress 5.1 CSRF to Remote Code Execution

A Pentester's Guide to Cross-Site Scripting (XSS)