WordPress Cross References Plugin <= 1.7 - Local File Inclusion

Because of this vulnerability, the attackers can read arbitrary files via a full pathname in the "rss" parameter to proxy.php. Solution Update the plugin...