CVE-2016-15041

HIGHNuclei

MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2016-15041 has a selected CVSS score of 7.2 (high); EIP currently links 1 repository PoC, 1 Nuclei template, and 1 lab environment.

Description

The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

MainWP Dashboard -The Private WordPress Manager for Multiple Website Maintenance Plugin

Browse MainWP / MainWP Dashboard -The Private WordPress Manager for Multiple Website Maintenance Plugin
VulnCheckVersion data not supplied

MainWP Dashboard: Self-hosted WordPress Management for Agencies

Browse mainwp / MainWP Dashboard: Self-hosted WordPress Management for Agencies

Default status: unaffected

CVE ListBefore 3.1.3affected

Proofs of concept

1

Repository PoCs

GitHubflame-11/CVE-2016-15041-mainwp-dashboardRepository PoCby flame-110Exploit7 files

2.5 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Bash script (poc.sh) that exploits payload withheld, an unauthenticated stored XSS vulnerability in MainWP Dashboard <= 3.1.2. It fetches a nonce, injects a JavaScript payload via the mwp_setup_purchase_username parameter, and verifies the payload is stored.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Dockerfile, README, and a PoC shell script for payload withheld, a stored XSS vulnerability in the MainWP Dashboard WordPress plugin. The Dockerfile builds a lab environment, the README documents the vulnerability and usage, and the PoC script demonstrates the unauthenticated XSS injection. No backdoor, deceptive payload, or concealed operator-directed harm is present. The PoC script performs only the documented XSS proof-of-concept actions: fetching a nonce, injecting a benign alert() payload, and verifying storage. No persistence, credential theft, unrelated remote access, or hidden executable behavior is observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesShell
Target softwareMainWP Dashboard WordPress plugin
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively injects a malicious payload into a vulnerable application and verifies its storage, which constitutes exploitation, not just detection.

scripts/poc.sh:2scripts/poc.sh:28-34

Requirements

  • Target running MainWP Dashboard plugin version <= 3.1.2README.md:52
  • Network access to the target WordPress instancescripts/poc.sh:7

Observed behavior

  • Fetches a CSRF nonce from the unauthenticated setup wizard endpointscripts/poc.sh:16-17
  • Constructs an XSS payload that breaks out of an HTML attribute using a double quote and injects an onmouseover event handlerscripts/poc.sh:29
  • Sends a POST request with the XSS payload to the vulnerable endpoint without authenticationscripts/poc.sh:31-34
  • Verifies the payload is stored by checking for a unique marker in the responsescripts/poc.sh:41
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
Payload withheldThe PoC script injects a benign XSS payload that triggers an alert with the document domain, consistent with a standard proof-of-concept for a stored XSS vulnerability.scripts/poc.sh:29
Vulnerability Target
Payload withheldThe artifact is a lab and PoC for a known CVE, with no indication of additional malicious functionality beyond demonstrating the vulnerability.README.md:1-3
Review boundaries

What the analysis did not establish

  • A binary zip file (mainwp-3.1.2-vulnerable.zip) is present but was not analyzed; its contents could contain additional exploit or scanner code.
  • Only 3 of 7 total files were provided as text; the remaining 4 files (including the binary) were omitted or not analyzed.
  • One binary file (mainwp-3.1.2-vulnerable.zip, 2.5 MB) was not analyzed; only its metadata is included. The PoC script does not interact with this file, and the Dockerfile only unzips it for lab setup. No backdoor indicators are present in the analyzed text, but the zip contents were not inspected.
  • Three text files (docker-compose.yml, docker-entrypoint-custom.sh, and one other) are present in the repository but their content is omitted from the evidence packet. The included files do not reference any suspicious behavior in these omitted files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

flame-11/CVE-2016-15041-mainwp-dashboardCreated Vuln labCVE-2016-15041Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that deploys a WordPress 6.2 instance with a vulnerable MainWP Dashboard plugin (version 3.1.2) for demonstrating CVE-2016-15041, an unauthenticated stored XSS vulnerability.

docker-compose.yml:1-33Dockerfile:1-40README.md:1-83

Lab assessment

Vulnerability lab

The README explicitly states it is a 'Vulnerable lab for CVE-2016-15041', the Dockerfile installs a patched vulnerable plugin, and a PoC script is provided to exercise the XSS.

README.md:1-3Dockerfile:3-12scripts/poc.sh:1-3
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

MySQL database server

MySQL 5.7.44 service providing the database backend for WordPress, with healthcheck and persistent volume.

docker-compose.yml:2-15

wordpress

WordPress application servervulnerable target

WordPress 6.2 container built from a custom Dockerfile that installs the vulnerable MainWP Dashboard plugin and a custom entrypoint for automated setup.

docker-compose.yml:17-28Dockerfile:1-40

docker-entrypoint-custom.sh

automated lab setup script

Custom entrypoint that waits for MySQL, installs WordPress via WP-CLI, activates the vulnerable plugin, and prints lab access information.

docker-entrypoint-custom.sh:1-58

mainwp-3.1.2-vulnerable.zip

vulnerable plugin archive

ZIP archive containing the MainWP Dashboard plugin version 3.1.2 with PHP 8 compatibility patches; the XSS vulnerability remains unpatched.

Dockerfile:3-12Dockerfile:20-23

scripts/poc.sh

proof-of-concept exploit script

Bash script that demonstrates the unauthenticated stored XSS by fetching a nonce, injecting a payload, and verifying its storage.

scripts/poc.sh:1-60
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2016-15041

Supported by supplied evidence

The lab explicitly targets CVE-2016-15041, the Dockerfile installs the vulnerable plugin version, and the PoC script exercises the described unauthenticated stored XSS via the mwp_setup_purchase_username parameter.

README.md:1-3Dockerfile:3-12scripts/poc.sh:1-3scripts/poc.sh:30-35
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:7-9
  • The lab must be started with 'docker compose up -d --build' and allowed ~30 seconds for auto-setup.README.md:7-11
  • The vulnerable endpoint is accessible without authentication at the specified URL.README.md:17-18

Evidence-described exercise path

  1. Start the lab using 'docker compose up -d --build' and wait for the setup banner.README.md:7-11
  2. Access the vulnerable endpoint to obtain a CSRF nonce (no authentication required).scripts/poc.sh:14-22
  3. Inject the XSS payload via a POST request to the same endpoint with the nonce.scripts/poc.sh:24-35
  4. Verify the payload is stored by checking the response, and note that the XSS will execute when an admin views the Extensions page.scripts/poc.sh:37-55
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers: the custom entrypoint only installs WordPress and activates the plugin, the PoC script only targets the local WordPress instance, and no host escape, external connectivity, persistence, or destructive actions are present.

docker-entrypoint-custom.sh:1-58scripts/poc.sh:1-60docker-compose.yml:1-33
Review boundaries

What the analysis did not establish

  • The vulnerable plugin archive (mainwp-3.1.2-vulnerable.zip) is an uninspected binary; its exact contents and any hidden behavior cannot be verified.
  • The Dockerfile downloads wp-cli.phar from an external URL; the downloaded binary is not inspected.
  • The lab relies on an external Nuclei template URL for validation, which is not part of the supplied evidence.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Nuclei templates

1
ProjectDiscoveryHIGHMainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting

MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to 3.1.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'mwp_setup_purchase_username' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.

Impact

Unauthenticated attackers can inject scripts that execute in users' browsers, potentially leading to session hijacking, defacement, or redirection.

Remediation

Update to the latest version of the plugin that addresses this vulnerability.

Authorsflame
Template tagscvecve2016mainwpwordpressxsswpwp-pluginvkev
FOFA: /wp-content/plugins/mainwp/
https://klikki.fi/mainwp-admin-panel-unauthenticated-stored-xss/

Source: ProjectDiscovery

References

5