CVE-2014-125132

Deferred Deferred - Pending Action

Reflected XSS in Blogroll Fun WordPress Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2014-125132

Affected Vendors & Products

Vendor	Product	Version / Range
Jason Newman	Blogroll Fun	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Blogroll Fun plugin for WordPress before version 0.8.5 has a reflected cross-site scripting (XSS) vulnerability. This means attackers can inject malicious scripts through the 'k' parameter in the blogroll.php file. The scripts are executed in the browsers of users who access a crafted link, without requiring authentication.

Detection Guidance

Check for the presence of the Blogroll Fun plugin in your WordPress installation. Look for requests to /wp-content/plugins/blogroll-fun/blogroll.php with a 'k' parameter in URLs. Monitor server logs for unsanitized input echoes or unusual JavaScript execution in responses.

Impact Analysis

This vulnerability allows attackers to steal user sessions, deface websites, or deliver malware to visitors. Users visiting a compromised site may have their data exposed or be redirected to malicious sites. Website owners risk reputational damage and potential legal consequences.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect user data from such attacks.

Mitigation Strategies

Update the Blogroll Fun plugin to version 0.8.5 or later. If updating is not possible, consider disabling or removing the plugin immediately. Implement input validation and output encoding in WordPress configurations to prevent XSS attacks.

Hi! I’m here to help you understand CVE-2014-125132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...