The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view