EIP-2026-114296

This exploit demonstrates a stored XSS vulnerability in the WordPress Zingiri Web Shop Plugin <= 2.4.2. The attacker injects malicious JavaScript payloads into the 'wsfeature1[]' and 'wsfeature2[]' form fields, which are then stored in the database and executed when an administrator views the order details.