How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

How to Fix and Prevent XSS Attacks in WordPress - IsItWP

TrustedSec Tricks for Weaponizing XSS

XSS vulnerability in the ASP.NET application: CVE-2023–24322 in

TrustedSec Tricks for Weaponizing XSS

TrustedSec Tricks for Weaponizing XSS

WordPress XSS Attack, Symptoms, Example

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

How Hackers Create Hidden Admin Users on your WordPress Blog

WordPress (Core) Stored XSS Vulnerability: An Analysis