.. / CVE-2016-10973

• XSS
• Nuclei
• Web

Exploit for Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting (CVE-2016-10973)

Description:

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.

Nuclei Template

View the template here CVE-2016-10973.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2016/CVE-2016-10973.yaml

References: