How To Discover 1352 Wordpress Plugin XSS 0days in One Hour

No ratings

Presented at bsidesboston 2016 by

Larry Cashdollar

In a single night, I was able to find about 1400 vulnerabilities in wordpress plugins. Not only that, but they were all a single kind of vulnerability, cross site scripting (XSS). Using techniques that I have developed, I was able to mass download plugins and scan them for unsanitized outputs from a user. In this talk, I will show how I did it and how I have responsibly notified the community.