First some context. I am Working for a company learning about Security Web Services. They have a main application and a blog. I've been looking vuln. in the main webapp for a while, but then I start looking in the blog that it was made with Wordpress Having the version 5.1.1 getting the info with wpscan command.
Wpscan command also says that the blog has:
- Multiple Vulnerabilities (Including SQLI) because of WPLM <=220.127.116.11
- Cross-Site Scripting (XSS) in Accept-Language Header because of WPLM 2.9.3-3.2.6
All because of the plugin "sitepress-multilingual-cms" That has the version 18.104.22.168
Ther problem here is that when i try to trigger the link nothing appears, and stand in a normal way in the main page. I am doing something wrong? Is it possible that new versions of Wordpress could fix this issue? Or new versions of the browser?
Now what I am trying to explain is that the vulnerability exist and it still dangerous even if I am not able to exploit it. I am right?
If it is exploitable I'd like to learn how to.
Could be just the syntax is not comtible with my browser.
- Info About First Vulnerabiltiy