<!--
# Exploit Title: Wordpress Captain Slider Store=
d XSS
# Date: 2015/8/29
# Exploit Author: Arash Khazaei .
# Vendor=
Homepage:
https:=
//wordpress.org/plugins/captain-slider/# Software Link:
https://download=
s.wordpress.org/plugin/captain-slider.zip# Version: 1.0.6
# Test=
ed on: Kali , Iceweasel Browser
# CVE : N/A
# Contact :
http://twitter.com/0xClay# Email :
0xclay@gmail.com# Site :
http://bhunter.ir# Intrduction :
# Wor=
dpress Captain Slider Plugin Have 3000+ Active Install
# And Suffer Fro=
m A Stored XSS Vulnerability In Title And Caption Section .
# Authors , =
Editors And Of Course Administrators This Vulnerability To Harm WebSite .
# Exploit :
# To Exploit This Vulnerability Go To Manage Sild=
er Section And Add Slider In Title And Caption add Your Js Code .
# Afte=
r Adding New Slider Go To Sorter Section Then You Can See Js Codes Executed=
.
Vulnerable Code :
-->
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=
=A0=C2=A0 <th class=3D"column-order"><?php _e('Order=
', 'ctslider'); ?></th>
=C2=A0=C2=A0=C2=A0 =C2=A0=
=C2=A0=C2=A0 <th class=3D"column-thumbnail"><?php _e(=
9;Slide Image', 'ctslider'); ?></th>
=C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0 <th class=3D"column-title"><?p=
hp _e('Title', 'ctslider'); ?></th>
=C2=A0=C2=
=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0
<!--=
Discovered By Arash Khazaei (Aka JunkyBoy) -->