Tricks for Weaponizing XSS

This blog post demonstrates weaponizing a stored XSS vulnerability in WordPress to create a new administrator account: it shows hosting a remote payload, using XMLHttpRequest to fetch /wp-admin/user-new.php, parsing the _wpnonce_create-user CSRF token from the response, and submitting a crafted POST to add a user, including full example code and mitigation notes.