How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

How to craft an XSS payload to create an admin user in Wordpress

HTTP Request Smuggling – Reflected XSS via Headers – Scomurr's Blog

How to Fix and Prevent XSS Attacks in WordPress - IsItWP

Cross-Site Scripting: The Real WordPress Supervillain

TrustedSec Tricks for Weaponizing XSS

WordpreXSS Exploitation » Rainbow and Unicorn

Attacking WordPress

XSS to RCE – using WordPress as an example

XSS Injection Campaign Exploits WordPress AMP Plugin

How to Fix and Prevent XSS Attacks in WordPress - IsItWP

Patching an XSS Security Bug in add-comments Plugin - Patchstack

A Pentester's Guide to Cross-Site Scripting (XSS)

XSS to RCE – using WordPress as an example

What is XSS? How to Protect Your Website from DOM Cross-Site