Ethical Hacking Automation

Automate Recon and scanning process with Vidoc. All security teams in one place

WordPress FlagEm - Cross-Site Scripting

By kannthu

Vidoc logoVidoc Module

What is "WordPress FlagEm - Cross-Site Scripting?"

The "WordPress FlagEm - Cross-Site Scripting" module is designed to detect a cross-site scripting vulnerability in the WordPress FlagEm plugin. This vulnerability allows an attacker to execute arbitrary scripts in the browser of an unsuspecting user. The severity of this vulnerability is classified as high, with a CVSS score of 7.2.

The original author of this module is daffainfo.


If exploited, this cross-site scripting vulnerability can lead to various malicious activities, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or injecting malicious content into the affected website.

How the module works?

The module sends an HTTP GET request to the following path:


The module then applies the following matching conditions:

- The response body must contain the string </script><script>alert(document.domain)</script> - The response header must contain the string text/html - The HTTP status code must be 200

If all the matching conditions are met, the module reports the vulnerability.

Module preview

Concurrent Requests (1)
1. HTTP Request template
Matching conditions
word: </script><script>alert(document.domain)<...and
word: text/htmland
status: 200
Passive global matcher
No matching conditions.
On match action
Report vulnerability