How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

CVE-2021-33851 - Stored Cross-Site Scripting in WordPress

WordPress website attack using JavaScript and XSS

10 Practical scenarios for XSS attacks

WordPress (Core) Stored XSS Vulnerability: An Analysis

WordpreXSS Exploitation » Rainbow and Unicorn

XSS: A Gateway to Command and Control, by Mawee

Persistent Cross-Site Scripting in WooCommerce using image

XSS: A Gateway to Command and Control, by Mawee

Stored Cross-site Scripting (XSS) leads to Account Takeover

TrustedSec Tricks for Weaponizing XSS

Luke (hakluke) Stephens on LinkedIn: Some programs will upgrade

Reflected XSS in WordPress Plugin Admin Pages

How to Fix and Prevent XSS Attacks in WordPress - IsItWP