EIP-2026-114328

The exploit demonstrates multiple input-validation vulnerabilities in the flashnews WordPress theme, including XSS and arbitrary file upload/execution via the `thumb.php` and `test.php` endpoints. The provided URLs showcase how an attacker can inject malicious scripts or upload arbitrary files.