CVE-2021-24365 WordPress Admin Columns XSS漏洞

XSS

Proof of Concept (PoC):

1. Create a custom field for WordPress users which allows storing HTML
    control characters. This can be done, e.g., with the "Advanced Custom
    Fields" plug-in 2.

2. Store "<img src=0 onerror=alert()>" in the custom field for any user.

3. Open the Admin Columns plug-in settings.

4. Choose the "Admin Columns" tab and select "Users" from the drop-down
    menu.

5. Click "Add Column", choose the type "Custom Field" and select the
    previously created custom field.

6. Open the user list in the WordPress back end. The JavaScript code
    will be executed.