EIP-2026-114124

The exploit demonstrates a reflected XSS vulnerability in the Trashbin plugin for WordPress by injecting a malicious script via the 'mtb_undelete' parameter. The payload executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies or performing other malicious actions.