EIP-2026-114178

The exploit demonstrates a stored XSS vulnerability in the WordPress Plugin visitors-app 0.3 via the 'user-agent' parameter. It uses a crafted curl command to inject malicious JavaScript, which redirects users to an attacker-controlled page when viewed in the WordPress admin panel.