Ethical Hacking Automation

Automate Recon and scanning process with Vidoc. All security teams in one place

WordPress Ambience Theme <=1.0 - Cross-Site Scripting

By kannthu

Vidoc logoVidoc Module

What is the "WordPress Ambience Theme <=1.0 - Cross-Site Scripting" module?

The "WordPress Ambience Theme <=1.0 - Cross-Site Scripting" module is a test case designed to detect a cross-site scripting vulnerability in the WordPress Ambience Theme version 1.0 and earlier. This vulnerability has a medium severity level.


A successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users of the WordPress Ambience Theme. This can lead to various consequences, such as unauthorized access to sensitive information, session hijacking, or the spread of malware.

How the module works?

The module sends an HTTP GET request to the "/wp-content/themes/ambience/thumb.php?src=%3Cbody%20onload%3Dalert(1)%3E.jpg" path of the target WordPress website. It then applies several matching conditions to determine if the vulnerability exists:

- The response body must contain the code "<body onload=alert(1)>". - The response header must include the content type "text/html". - The HTTP status code must be 200.

If all of these conditions are met, the module reports the presence of the cross-site scripting vulnerability in the WordPress Ambience Theme.

For more information about this module, please refer to the original author's documentation.

Module preview

Concurrent Requests (1)
1. HTTP Request template
Matching conditions
word: <body onload=alert(1)>and
word: text/htmland
status: 200
Passive global matcher
No matching conditions.
On match action
Report vulnerability