How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

Securin (previously CSW) Discovers Stored Cross-Site Scripting

WordPress (Core) Stored XSS Vulnerability: An Analysis

Part 4 - OWASP Top 10 Vulnerabilities Affecting WordPress Applications

WordPress XSS Attack, Symptoms, Example

XSS (Cross Site Scripting) Part 1 – What is XSS? – simpleisbest.co.uk

XSS: A Gateway to Command and Control, by Mawee

XSS: A Gateway to Command and Control, by Mawee

WordPress XSS Attacks- How To Protect Your Website Explained

XSS Vulnerability (CVE-2023-30777)

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

Wordpress Reverse Shell : Multiple Methods - Hackercool Magazine

Stored Cross-site Scripting (XSS) leads to Account Takeover

WP GDPR Compliance <= 1.5.5 - Unauthenticated Cross-Site Scripting