flame-11/cve-2016-15041-mainwp-dashboardVuln lab: MainWP Dashboard <= 3.1.2 Unauthenticated Stored XSS
Vulnerable lab for CVE-2016-15041: Unauthenticated stored XSS in MainWP Dashboard WordPress plugin <= 3.1.2.
docker compose up -d --build
Wait ~30 seconds for auto-setup. The lab prints a banner when ready:
docker compose logs -f wordpress
| Resource | URL / Credentials |
|---|
| WordPress | http://localhost:8088 |
| Admin Login | admin / admin123 |
| Vulnerable Endpoint | http://localhost:8088/wp-admin/admin-post.php?page=mainwp-setup&step=purchase_extension |
Nuclei:
nuclei -t https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2016/CVE-2016-15041.yaml -u http://localhost:8088
Manual PoC:
./scripts/poc.sh http://localhost:8088
docker compose down -v
| Field | Value |
|---|---|
| CVE | CVE-2016-15041 |
| Severity | High |
| Type | Stored XSS (Unauthenticated) |
| Affected | MainWP Dashboard <= 3.1.2 |
| Fixed | 3.1.3 |
The MainWP Dashboard Quick Setup Wizard is accessible without authentication. An attacker can inject JavaScript via the mwp_setup_purchase_username parameter. The payload is stored in WordPress options and rendered without escaping when an admin views the Extensions page.
GET /wp-admin/admin-post.php?page=mainwp-setup&step=purchase_extension → get CSRF nonce (no auth required)POST XSS payload with the nonce (no auth required)The vulnerable plugin (v3.1.2) was obtained from WordPress SVN revision r1394563 (April 14, 2016). Minor PHP 8 compatibility patches were applied that do not affect the vulnerability:
__autoload() with spl_autoload_register()The XSS vulnerability exists in view/view-mainwp-extensions-view.php line 74 where $username is echoed without esc_attr().