EIP-2026-113891

This exploit demonstrates a CSRF vulnerability in Metronet Tag Manager 1.2.7, allowing an attacker to inject arbitrary JavaScript into the plugin's settings. The PoC shows how an attacker can trick an admin into submitting a malicious form, leading to stored XSS.