# Exploit Title: Wordpress statspressCN search Keywords stored XSS
# Date: 21-1-2010
# Author: Saif El-Sherei
# Software Link: http://downloads.wordpress.org/plugin/statpresscn.1.9.0.zip
# Version: wordpress(3.0.4), StatsCN(1.9.0)
# Tested on: Firefox 3.0.15, , IE 8


Info:

This plugin shows you real time statistics about your blog, track your
friends's visit, provide function such as post's hotness, hottest post,
related post, visitor's list at current time, also support for Chinese
perfectly. It collects information about visitors, spiders, search keywords,
feeds, browsers, OS etc. If own a wordpress blog, you can use it freely,
nothing else needed. Having fun!

POC:

<script>alert(1);</script>
<script>alert('AAAAAAAAAAAAAA');</script>

Details:

Due to size limitation for search keyword in StatsCN dashboard; You can only
cause a defacment to it & the script wont run; but in the spy section, there
is no size limitation so an attacker can use any XSS attack he wants you can
use the 2nd POC for that.


Regards,

Saif El-Sherei

OSCP