Ethical Hacking Automation

Automate Recon and scanning process with Vidoc. All security teams in one place

WordPress Finder - Cross-Site Scripting

By kannthu

Vidoc logoVidoc Module

What is the "WordPress Finder - Cross-Site Scripting?"

The "WordPress Finder - Cross-Site Scripting" module is designed to detect a cross-site scripting vulnerability in the WordPress Plugin Finder. This vulnerability allows an attacker to execute arbitrary scripts in the browser of an unsuspecting user. The severity of this vulnerability is classified as high, with a CVSS score of 7.2.

The original author of this module is daffainfo.


If exploited, this cross-site scripting vulnerability can lead to various malicious activities, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or injecting malicious content into the affected website.

How the module works?

The "WordPress Finder - Cross-Site Scripting" module works by sending a specific HTTP request to the target WordPress website. The request is made to the "/wp-content/plugins/finder/index.php" endpoint with the "order" parameter containing a crafted payload.

For example:


The module then checks the response of the HTTP request against several matching conditions:

- The response body must contain the string "</script><script>alert(document.domain)</script>" - The response headers must include the string "text/html" - The HTTP status code must be 200

If all the matching conditions are met, the module reports the vulnerability.

Module preview

Concurrent Requests (1)
1. HTTP Request template
Matching conditions
word: </script><script>alert(document.domain)<...and
word: text/htmland
status: 200
Passive global matcher
No matching conditions.
On match action
Report vulnerability