CVE-2014-4941

Cross-RSS for WordPress (plugin 1.7) is affected by an Absolute Path Traversal via the rss parameter to proxy.php, enabling reading arbitrary server files. Root cause: local file inclusion in the plugin’s handling of the rss input. Impact: potential exposure of sensitive files on the server. Reme...

PT-2014-6220

Name of the Vulnerable Software and Affected Versions wp-cross-rss plugin version 1.7 Description The issue allows remote attackers to read arbitrary files by providing a full pathname in the rss parameter to the "proxy.php" endpoint. Recommendations For wp-cross-rss plugin version 1.7, consider...