Live › vulnerability › CVE-2014-125132
Go to dashboardThe Blogroll Fun plugin for WordPress before 0.8.5 echoes the 'k' parameter of blogroll.php without sanitizing it. An attacker who tricks a visitor into opening a crafted link can run JavaScript in that visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Blogroll Fun WordPress plugin at a version before 0.8.5 are exposed, because the vulnerable blogroll.php file is reachable by anyone over HTTP without logging in. Sites that do not have this plugin installed are not affected. Sites that have already updated or removed the plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/blogroll-fun/blogroll.php on the WordPress server/wp-content/plugins/blogroll-fun/blogroll.php with a 'k' parameter0.8.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2014-125132")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.