How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

Stored Cross-Site Scripting Vulnerability in WordPress 4.8.1

WordPress XSS Attacks- How To Protect Your Website Explained

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

XSS Vulnerability (CVE-2023-30777)

HTTP Request Smuggling – Reflected XSS via Headers – Scomurr's Blog

Stored XSS (Cross Site Scripting) vulnerability in page title

WordPress 5.1 CSRF to Remote Code Execution

WordPress XSS to RCE Vulnerability

XSS with a JPG/JPEG to bypass CSP

53973 (WordPress <= 5.8 - Authenticated Persistent XSS (User role

The impact of an XSS vulnerability on WordPress: How hackers

WP GDPR Compliance <= 1.5.5 - Unauthenticated Cross-Site Scripting

Securin (previously CSW) Discovers a XSS Vulnerability in