EIP-2026-114380

This exploit demonstrates a stored XSS vulnerability in WP-UserOnline 2.88.0, allowing an authenticated attacker to inject JavaScript that creates a new administrator account via AJAX requests.