How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

WordPress XSS to RCE Vulnerability

Stored XSS Vulnerability found in Strong Testimonials Plugin

What is Cross-site Scripting and How Can You Fix it?

How to Test and Protect WooCommerce Plugins XSS Vulnerability?

The impact of an XSS vulnerability on WordPress: How hackers

Luke (hakluke) Stephens on LinkedIn: Some programs will upgrade

Securin (previously CSW) Discovers Stored Cross-Site Scripting

What is XSS? How to Protect Your Website from DOM Cross-Site

Securin (previously CSW) Discovers Stored Cross-Site Scripting

Cross-Site Scripting: The Real WordPress Supervillain