This host is running WordPress and is prone to Cross Site Scripting vulnerability.

Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Impact Level: Application.

No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.

The flaw is due to an input passed to 'i' parameter in 'wp-content/plugins/feedlist/handler_image.php' script is not properly sanitised before being returned to the user.

WordPress FeedList plugin version 2.61.01

• http://secunia.com/advisories/42197
• http://www.johnleitch.net/Vulnerabilities/WordPress.Feed.List.2.61.01.Reflected.Cross-site.Scripting/56
• http://xforce.iss.net/xforce/xfdb/63055

---

Updated on 2015-03-25