CVE-2014-5347

🗓️ 19 Aug 2014 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 42 Views🌐 WEB

CVE-2014-5347 Multiple CSRF and XSS vulnerabilities in Disqus Comment System plugin for WordPres

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2014-5347	19 Aug 201419:00	–	cvelist
EUVD	EUVD-2014-5236	7 Oct 202500:30	–	euvd
NVD	CVE-2014-5347	19 Aug 201419:55	–	nvd
Prion	Cross site request forgery (csrf)	19 Aug 201419:55	–	prion
WPVulnDB	Disqus <= 2.75 - Cross-Site Scripting (XSS) & CSRF	12 Aug 201400:00	–	wpvulndb

NVD

Node

Source	Link
exploit-db	www.exploit-db.com/exploits/34336
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/95289
packetstormsecurity	www.packetstormsecurity.com/files/127852/Disqus-2.7.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
securityfocus	www.securityfocus.com/bid/69205
nikcub	www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin
seclists	www.seclists.org/fulldisclosure/2014/Aug/35
wordpress	www.wordpress.org/plugins/disqus-comment-system/other_notes
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/95288
gist	www.gist.github.com/nikcub/cb5dc7a5464276c8424a
packetstormsecurity	www.packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
disqus_replace	query param	wp-admin/edit-comments.php	CSRF flaw enabling attacker-controlled value for disqus_replace to trigger XSS via admin page.	CWE-352
disqus_public_key	query param	wp-admin/edit-comments.php	CSRF flaw enabling attacker-controlled value for disqus_public_key to trigger XSS via admin page.	CWE-352
disqus_secret_key	query param	wp-admin/edit-comments.php	CSRF flaw enabling attacker-controlled value for disqus_secret_key to trigger XSS via admin page.	CWE-352
reset	query param	wp-admin/edit-comments.php	CSRF flaw enabling attacker-controlled reset parameter to alter plugin options on admin page.	CWE-352

17 Jun 2026 00:11Current

6.8Medium risk

Vulners AI Score6.8

CVSS 26.8

EPSS0.04886