When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/].

While pentesting some sites, I faced a common issue i.e it shows that Wordpress SEO 1.14.15 is vulnerable to Cross Site Scripting Attack. Output is given below:

 | * Title: WordPress SEO 1.14.15 - index.php s Parameter Reflected XSS
 
 | * Reference: [http://packetstormsecurity.com/files/123028/][2]
 
 | * Reference: http://osvdb.org/97885

But when following the link http://packetstormsecurity.com/files/123028/ , it shows that attack can be executed with

But the main problem is when I tried to inject several XSS vectors, the results were not positive. I was not able to find any XSS in above url. There is proper output encoding, a snapshot is shown below:  wordpress search xss

So my question is:

1. Do you have any method to bypass this and execute an XSS?
2. Do you have any other tool or resources through which I can do better blackbox testing of Wordpress?

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/].

While pentesting some sites, I faced a common issue i.e it shows that Wordpress SEO 1.14.15 is vulnerable to Cross Site Scripting Attack. Output is given below:

 | * Title: WordPress SEO 1.14.15 - index.php s Parameter Reflected XSS
 
 | * Reference: [http://packetstormsecurity.com/files/123028/][2]
 
 | * Reference: http://osvdb.org/97885

But when following the link http://packetstormsecurity.com/files/123028/ , it shows that attack can be executed with

But the main problem is when I tried to inject several XSS vectors, the results were not positive. I was not able to find any XSS in above url. There is proper output encoding, a snapshot is shown below: 

So my question is:

1. Do you have any method to bypass this and execute an XSS?
2. Do you have any other tool or resources through which I can do better blackbox testing of Wordpress?

When it comes to blackbox pentesting of a wordpress site  ,first thing come's in your mind is WPScan[http://wpscan.org/].While pentesting through some site's ,i faced a similar issue i.e it shows that Wordpress SEO 1.14.15 is vulnerable to Cross Site Scripting Attack. Output is given below

| * Title: WordPress SEO 1.14.15 - index.php s Parameter Reflected XSS

| * Reference: http://packetstormsecurity.com/files/123028/

| * Reference: http://osvdb.org/97885

But when following the link http://packetstormsecurity.com/files/123028/ ,it shows that attack can be executed with

But the main problem is when i tried to inject several xss vector's ,result's were not positive  .I was not able to find any XSS in above url.There is proper output encoding  ,a snapshot is shown below .So my question is "Do you have any method to bypass this and execute an xss " and "Do you any other tool or resources through which i can do better blackbox testing of wordpress"

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan  [http://wpscan.org/].

While pentesting some sites, I faced a common issue i.e it shows that Wordpress SEO 1.14.15 is vulnerable to Cross Site Scripting Attack. Output is given below:

 | * Title: WordPress SEO 1.14.15 - index.php s Parameter Reflected XSS
 
 | * Reference: [http://packetstormsecurity.com/files/123028/][2]
 
 | * Reference: http://osvdb.org/97885

But when following the link http://packetstormsecurity.com/files/123028/ , it shows that attack can be executed with

But the main problem is when I tried to inject several XSS vectors, the results were not positive. I was not able to find any XSS in above url. There is proper output encoding, a snapshot is shown below: wordpress search xss

So my question is:

1. Do you have any method to bypass this and execute an XSS?
2. Do you have any other tool or resources through which I can do better blackbox testing of Wordpress?