CVE-2014-4941

Cross-RSS for WordPress (plugin 1.7) is affected by an Absolute Path Traversal via the rss parameter to proxy.php, enabling reading arbitrary server files. Root cause: local file inclusion in the plugin’s handling of the rss input. Impact: potential exposure of sensitive files on the server. Reme...