.. / CVE-2015-4127

Exploit for WordPress Church Admin <0.810 - Cross-Site Scripting (CVE-2015-4127)

Description:

WordPress Church Admin plugin before 0.810 allows remote attackers to inject arbitrary web script or HTML via the address parameter via index.php/2015/05/21/church_admin-registration-form/.

Nuclei Template

View the template here CVE-2015-4127.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2015/CVE-2015-4127.yaml
Copy

References:

https://github.com/ARPSyndicate/cvemon
https://www.exploit-db.com/exploits/37112
https://wpscan.com/vulnerability/2d5b3707-f58a-4154-93cb-93f7058e3408
https://nvd.nist.gov/vuln/detail/CVE-2015-4127
https://wordpress.org/plugins/church-admin/changelog/