{"vulnerability": "cve-2021-25075", "sightings": [{"uuid": "d4b90a44-8c5d-4f1a-b831-186e5dbd3414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25075", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25075.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "00a8c77d-ff54-40ff-9f00-f17cb9459269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25075", "type": "seen", "source": "https://t.me/hacking_Attack/51199", "content": ".  Analysis of the endpoint's code will tell you that this indeed leads to a stored XSS  vulnerability: CVE-2021-25075 (https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b).  False positives  Unfortunately, for most of the plugins the fuzzer doesn't find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:  Call: wp_mail arguments={'to': 'plugin@pluginvendor.com', 'subject': '[Plugin contact]  - http://GARLICGARLICGARLIC.example.com'}    This can mean, that wp_mail is indeed called, but you don't control the recipient  and most of the subject. If you want to be sure, look at the plugin source.  Additional tips for reading fuzzer reports    If you see the message; May as well be equal: ... and ... - that means that the mechanism  to pretend that a known payload is equal to any other string (described in  https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.  If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__ - that means that an uploaded  file access was detected. No further checks are currently made - to check whether this is a  vulnerability, look at the code.  Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world:  for example, you can't inject anything into $_GET['page'] if you want a particular menu page to be displayed.    Usage cheatsheet  The first run of fuzzing or of the tests may take about an hour, because  we need to build the Docker image with instrumented PHP and WordPress.  Fuzzing a plugin by name  ./bin/fuzz_plugin PLUGIN_SLUG    Fuzzing a plugin from file  You can also install a plugin from a local zip file:  ./bin/fuzz_plugin PLUGIN_FILE_NAME.zip    Printing findings  To print what the fuzzer found, use:  ./bin/print_findings data/plugin_fuzz_results/    Running tests  To run the tests, use:  ./bin/test    Warning: the tests take long (more than an hour) and because they check whether the fuzzer  would find vulnerabilities, they fail with some probability.  Reformatting code and running linters  To reformat and check the code, use:  ./bin/reformat    Manual testing environment  You may start a test environment with only one plugin installed using:  ./bin/manual_testing PLUGIN_SLUG|PLUGIN_PATH.zip [version]    You can install a plugin using its slug or from a local zip file.  It will listen on http://127.0.0.1:8001/  There will be two test users in the database:    username: admin, password: admin, privileges: administrator  username: subscriber, password: subscriber, privileges: subscriber    Extending and configuring the fuzzer  This tool is a proof of concept (https://www.kitploit.com/search/label/Proof%20Of%20Concept) - this section contains places where it can be improved to find  more vulnerabilities.  You may want to edit filtering.py -- it contains the rules that deem a particular crash  important or not. If you change them, you may have more false positives, but find more vulnerabilities  as well. For example, the only header that I consider interesting when emitted is the Location  header, to detect Open Redirect (https://www.kitploit.com/search/label/Open%20Redirect) vulnerabilities. That is just one idea and you may have others.  Another file that may be worth extending is docker_image/patch_wordpress.sh. It describes  calls to which functions will be logged as interesting.  If you want to inject other payloads (or change the probabilities with which they are injected)  edit docker_image/magic_payloads.php and docker_image/fuzz/config.py.  crash_detector.py contans regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) that find interesting crashes or interesting  information (e.g. e-mails) being exposed.  Fuzzing files (i.e. executing each PHP file with injected payloads) has been disabled  because it didn't lead to many findings. Uncomment files in  config.DEFAULT_ENABLED_FEATURES  to change that.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.100653Z"}, {"uuid": "191b0cfc-4cfd-46af-8bfd-8cdec0a4dc46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25075", "type": "seen", "source": "https://t.me/hacking_Attack/51199", "content": ".  Analysis of the endpoint's code will tell you that this indeed leads to a stored XSS  vulnerability: CVE-2021-25075 (https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b).  False positives  Unfortunately, for most of the plugins the fuzzer doesn't find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:  Call: wp_mail arguments={'to': 'plugin@pluginvendor.com', 'subject': '[Plugin contact]  - http://GARLICGARLICGARLIC.example.com'}    This can mean, that wp_mail is indeed called, but you don't control the recipient  and most of the subject. If you want to be sure, look at the plugin source.  Additional tips for reading fuzzer reports    If you see the message; May as well be equal: ... and ... - that means that the mechanism  to pretend that a known payload is equal to any other string (described in  https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.  If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__ - that means that an uploaded  file access was detected. No further checks are currently made - to check whether this is a  vulnerability, look at the code.  Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world:  for example, you can't inject anything into $_GET['page'] if you want a particular menu page to be displayed.    Usage cheatsheet  The first run of fuzzing or of the tests may take about an hour, because  we need to build the Docker image with instrumented PHP and WordPress.  Fuzzing a plugin by name  ./bin/fuzz_plugin PLUGIN_SLUG    Fuzzing a plugin from file  You can also install a plugin from a local zip file:  ./bin/fuzz_plugin PLUGIN_FILE_NAME.zip    Printing findings  To print what the fuzzer found, use:  ./bin/print_findings data/plugin_fuzz_results/    Running tests  To run the tests, use:  ./bin/test    Warning: the tests take long (more than an hour) and because they check whether the fuzzer  would find vulnerabilities, they fail with some probability.  Reformatting code and running linters  To reformat and check the code, use:  ./bin/reformat    Manual testing environment  You may start a test environment with only one plugin installed using:  ./bin/manual_testing PLUGIN_SLUG|PLUGIN_PATH.zip [version]    You can install a plugin using its slug or from a local zip file.  It will listen on http://127.0.0.1:8001/  There will be two test users in the database:    username: admin, password: admin, privileges: administrator  username: subscriber, password: subscriber, privileges: subscriber    Extending and configuring the fuzzer  This tool is a proof of concept (https://www.kitploit.com/search/label/Proof%20Of%20Concept) - this section contains places where it can be improved to find  more vulnerabilities.  You may want to edit filtering.py -- it contains the rules that deem a particular crash  important or not. If you change them, you may have more false positives, but find more vulnerabilities  as well. For example, the only header that I consider interesting when emitted is the Location  header, to detect Open Redirect (https://www.kitploit.com/search/label/Open%20Redirect) vulnerabilities. That is just one idea and you may have others.  Another file that may be worth extending is docker_image/patch_wordpress.sh. It describes  calls to which functions will be logged as interesting.  If you want to inject other payloads (or change the probabilities with which they are injected)  edit docker_image/magic_payloads.php and docker_image/fuzz/config.py.  crash_detector.py contans regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) that find interesting crashes or interesting  information (e.g. e-mails) being exposed.  Fuzzing files (i.e. executing each PHP file with injected payloads) has been disabled  because it didn't lead to many findings. Uncomment files in  config.DEFAULT_ENABLED_FEATURES  to change that.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:54.959461Z"}]}