[-] Title : wp-ticket - wordpress plugin - Cross-Site-Scripting [-] Author : Abolfazl Feyz [-] Vendor : https://github.com/wp-plugins/wp-ticket/archive/master.zip [-] Dork : inurl:wp-content/plugins/wp-ticket-master/ [-] date : 9.January.2021 ------------------------------------ Vulnerable page: /wp-content/plugins/wp-ticket-master/assets/ext/zebraform/process.php ------------------------------------ --------------------------------------------------- Vulnerable source: Line188 : $form = $_GET['form']; Line217 : echo echo $form; ---------------------------------------------------- -------------------------------------------------------- POC : http://site.com/wp-content/plugins/wp-ticket-master/assets/ext/zebraform/process.php?form=[XSS] ====================================== = cantact me = = Telegram ==> Mr_ramkal = = instagram ==> aboolfazl_feyz = = email ==> khodebolfazl@gmail.com = ======================================