# MakeSense - HackTheBox

Chaining a stored XSS in a WordPress contact form into admin takeover, RCE via a malicious plugin, SSH access, and a PHP file-upload bypass on an internal OCR service to root the box.