.. / CVE-2015-4063

Exploit for NewStatPress <0.9.9 - Cross-Site Scripting (CVE-2015-4063)

Description:

WordPress NewStatPress plugin before 0.9.9 contains a cross-site scripting vulnerability in includes/nsp_search.php. The plugin allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.

Nuclei Template

View the template here CVE-2015-4063.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-4063.yaml
Copy

References:

https://wordpress.org/plugins/newstatpress/changelog/
http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html
https://nvd.nist.gov/vuln/detail/CVE-2015-4063
https://packetstormsecurity.com/files/132038/
https://wordpress.org/plugins/newstatpress/