Wordpress core 3.1.3 Persistent XSS Vulnerability

                                                Title: Wordpress core 3.1.3 self-XSS
Author: Jelmer de Hen
Software link: http://wordpress.org/download/Version: 3.1.3

Wordpress 3.1.3 has a self-XSS vulnerability in the following pages:/wp-admin/user-edit.php?user_id=<uid>/wp-admin/profile.php
By putting Javascript inside the input elements "first_name", "last_name" or "nickname" the self-XSS will trigger 3 times.

Step 1: Go to www.google.com, it must be google.com and not google.ro or google.tu or other google.
Step 2: Delete the URL address in the navigation bar. Select the address, right click on the selection and delete.
Step 3: Copy and Paste in the Navigation bar this code:

javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.images; DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.left=Math.sin(R*x1+i*x2+x3)*x4+x5; DIS.top=Math.cos(R*y1+i*y2+y3)*y4+y5}R++}setInterval('A()',5); void(0);
Step 4: Hit enter.
Step 5: Watch Google Dance like Mad.
Step 6: This can be applied for any Website.
Step 7: Get over the pain because you just got slapped in the face by me because of your stupicity

That proofs that my "easter egg" idea might work pretty good.

The vulnerability itself exists in the following places of WordPress:

http://h.ackack.net/wp-admin/user-edit.php?user_id=

http://h.ackack.net/wp-admin/profile.php

By putting Javascript inside the input elements "first_name", "last_name" or "nickname" the self-XSS will trigger 3 times.

If you drag the image displayed earlier in 1 of these elements the XSS will trigger, or just by inserting "<script>alert(123);</script>" inside one of these elements you get the same effect.

As you can imagine we can pull of a generic way of social engineering people to get their blog pwned.

Step 1: Go to the http://<your website>/wp-admin/profile.php, log in if the page asks for it
Step 2: Put this code inside your "First name" field:

<script>alert(123);</script>

Step 3: See unicorns flying over your screen!

More information: http://h.ackack.net/0day-xss-in-wordpress-core.html