EIP-2026-113515

The exploit describes a stored XSS vulnerability in the WordPress plugin '3dady real-time web stats' version 1.0, where unsanitized input in the 'dady_input_text' and 'dady2_input_text' fields allows JavaScript execution. The PoC involves injecting an XSS payload into these fields, which triggers when saved.