Reflected Cross-Site Scripting in Blogroll Fun Plugin for WordPress
CVE-2014-125132

5.1MEDIUM

Key Information:

Vendor

WordPress
Status
Blogroll Fun
Vendor
CVE Published:
20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2014-125132?

The Blogroll Fun plugin for WordPress prior to version 0.8.5 contains a reflected cross-site scripting vulnerability through which unauthenticated attackers can exploit the 'k' parameter in blogroll.php. By crafting specially manipulated GET requests to /wp-content/plugins/blogroll-fun/blogroll.php, attackers can introduce malicious 'k' values that are echoed without proper sanitization, enabling the execution of arbitrary JavaScript in the browsers of unsuspecting users. This vulnerability poses a considerable risk, as it facilitates the potential for phishing and other malicious activity directed at site visitors.

Affected Version(s)

Blogroll Fun 0 < 0.8.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2014-125132 - Proof of Concept

References

https://codevigilant.com/disclosure/wp-plugin-blogroll-fu...
technical-descriptionexploit
https://www.acunetix.com/vulnerabilities/web/wordpress-pl...
third-party-advisory
https://github.com/projectdiscovery/nuclei-templates/blob...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anant Shrivastava
The Shadowserver Foundation
.