When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/].

While pentesting some sites, I faced a common issue i.e it shows that Wordpress SEO 1.14.15 is vulnerable to Cross Site Scripting Attack. Output is given below:

 | * Title: WordPress SEO 1.14.15 - index.php s Parameter Reflected XSS
 
 | * Reference: [http://packetstormsecurity.com/files/123028/][2]
 
 | * Reference: http://osvdb.org/97885

But when following the link http://packetstormsecurity.com/files/123028/ , it shows that attack can be executed with

But the main problem is when I tried to inject several XSS vectors, the results were not positive. I was not able to find any XSS in above url. There is proper output encoding, a snapshot is shown below: wordpress search xss

So my question is:

1. Do you have any method to bypass this and execute an XSS?
2. Do you have any other tool or resources through which I can do better blackbox testing of Wordpress?