CVE-2014-125132: Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php
Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated attackers can craft GET requests to the plugin's blogroll.php endpoint. Successful exploitation requires a victim to load the crafted request so the injected JavaScript executes in that victim's browser.
Which installations are exposed?
WordPress sites using Blogroll Fun versions earlier than 0.8.5 are affected if the plugin's blogroll.php file is reachable. The vulnerable input is the k parameter.
What should be reviewed for signs of exploitation?
Review web-server and application logs for requests to /wp-content/plugins/blogroll-fun/blogroll.php containing unusual or script-like values in the k parameter. Exploitation evidence was first observed on 2023-10-19.