How to craft an XSS payload to create an admin user in Wordpress

What I'll go through in this post is exactly how to capitalize on a particular (old) Wordpress plugin vulnerability to deliver a persistent XSS injection (not logged into Wordpress) that will later be executed by someone logged into Wordpress with higher privileges, such as an administrator.

Toxssin - An XSS Exploitation Command-Line Interface And Payload

Securin (previously CSW) Discovers Stored Cross-Site Scripting

Blind Cross-Site Scripting (XSS)

Reflected XSS in WordPress Plugin Admin Pages

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

TrustedSec Tricks for Weaponizing XSS

WordPress 5.8.2 Stored XSS Vulnerability

WordpreXSS Exploitation » Rainbow and Unicorn

What is Cross-site Scripting and How Can You Fix it?

WordPress XSS Attack (Cross Site Scripting) - How To Prevent?

XSS plugin vulnerabilities plague WordPress users – Sophos News

How hackers exploit XSS vulnerabilities to create admin accounts

HTTP Request Smuggling – Reflected XSS via Headers – Scomurr's Blog