{"id":"CVE-2014-125132","kind":"vulnerability","aliases":["CVE-2014-125132"],"related":[],"title":"Blogroll Fun WordPress plugin: reflected XSS via 'k' parameter","description":"Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","summary":"The Blogroll Fun plugin for WordPress before 0.8.5 echoes the 'k' parameter of blogroll.php without sanitizing it. An attacker who tricks a visitor into opening a crafted link can run JavaScript in that visitor's browser.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-0.8.5-or-later","plugin-not-installed"],"how_to_check":"- Look for the file `wp-content/plugins/blogroll-fun/blogroll.php` on the WordPress server\n- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header\n- Check the access logs for GET requests to `/wp-content/plugins/blogroll-fun/blogroll.php` with a 'k' parameter","fix":"- Update the Blogroll Fun plugin to `0.8.5` or later\n- If the plugin is not needed, remove it from the site","status":"open","published_at":"2026-10-20T21:17:12+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:04:01+00:00","updated_at":"2026-10-25T04:04:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:04:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Blogroll Fun plugin to `0.8.5` or later\n- If the plugin is not needed, remove it from the site","reach":"internet","title":"Blogroll Fun WordPress plugin: reflected XSS via 'k' parameter","impact":"medium","summary":"The Blogroll Fun plugin for WordPress before 0.8.5 echoes the 'k' parameter of blogroll.php without sanitizing it. An attacker who tricks a visitor into opening a crafted link can run JavaScript in that visitor's browser.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs JavaScript in a victim's browser on the site","analyst_note":"","how_to_check":"- Look for the file `wp-content/plugins/blogroll-fun/blogroll.php` on the WordPress server\n- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header\n- Check the access logs for GET requests to `/wp-content/plugins/blogroll-fun/blogroll.php` with a 'k' parameter","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-0.8.5-or-later"],"who_is_affected":"Sites running the Blogroll Fun WordPress plugin at a version before 0.8.5 are exposed, because the vulnerable blogroll.php file is reachable by anyone over HTTP without logging in. Sites that do not have this plugin installed are not affected. Sites that have already updated or removed the plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3407,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':116C '-125132':12A,15A '-19':117C '-2014':11A,14A '/wp-content/plugins/blogroll-fun/blogroll.php':91C '0.8.5':28B,63C '2023':115C 'allow':73C 'attack':39B,75C,85C 'blogrol':1A,22B,57C 'blogroll.php':34B,84C 'browser':56B,104C 'contain':64C 'craft':47B,87C 'cross':68C 'cross-sit':67C 'cve':10A,13A 'echo':29B,98C 'evid':106C 'execut':100C 'exploit':105C 'first':108C 'foundat':113C 'fun':2A,23B,58C 'get':88C 'host':19B 'inject':77C 'javascript':51B,101C 'k':8A,31B,81C,94C 'link':48B 'malici':93C 'observ':109C 'open':45B 'packag':16B 'paramet':9A,32B,82C 'plugin':4A,24B,59C 'reflect':5A,66C 'request':89C 'run':50B 'sanit':36B 'script':70C,78C 'self':18B 'self-host':17B 'shadowserv':112C 'site':69C 'trick':41B 'unauthent':74C 'unsanit':99C 'valu':95C 'via':7A 'victim':103C 'visitor':43B,54B 'vulner':71C 'without':35B 'wordpress':3A,20B,26B,61C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Blogroll Fun WordPress plugin at a version before 0.8.5 are exposed, because the vulnerable blogroll.php file is reachable by anyone over HTTP without logging in. Sites that do not have this plugin installed are not affected. Sites that have already updated or removed the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2014-125132","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125132","severity":null,"published_at":"2026-10-20T21:17:12+00:00","modified_at":"2026-10-22T16:53:20+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}