How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

XSS Injection Campaign Exploits WordPress AMP Plugin

XSS vulnerability in the ASP.NET application: CVE-2023–24322 in

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

WordPress website attack using JavaScript and XSS

Blind Cross-Site Scripting (XSS)

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

XSS: A Gateway to Command and Control, by Mawee

WordPress XSS Protection: Safeguard Your Site In 2023

TrustedSec Tricks for Weaponizing XSS

TrustedSec Scraping Login Credentials With XSS

Cross Site Scripting (XSS) - Payload Generator

WordPress XSS Attacks- How To Protect Your Website Explained

What is Cross-site Scripting and How Can You Fix it?

GitHub - hoodoer/WP-XSS-Admin-Funcs: JavaScript functions intended