EIP-2026-113856

The exploit demonstrates a reflected XSS vulnerability in Knews Multilingual Newsletters for WordPress by injecting a malicious script via the 'ff' parameter in the fontpicker endpoint. The payload executes arbitrary JavaScript in the context of the affected site.