• WordPress Plugin Post Recommendations for WordPress is prone to a remote file include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. WordPress Plugin Post Recommendations for WordPress version 1.1.2 is vulnerable; prior versions may also be affected.

• Update to the latest version

• • http://www.securityfocus.com/bid/54459/exploit
  • http://www.opensyscom.fr/Actualites/post-recommendations-for-wordpress-remote-file-inclusion-vulnerability.html
  • http://secunia.com/advisories/49945/

• 

• CWE-94

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• Missing Update File Inclusion

• WordPress Plugin RB Agency Local File Disclosure (2.4.7)
• Drupal Core 4.6.x Session Fixation (4.6.0 - 4.6.5)
• WordPress Plugin Username Changer Multiple Vulnerabilities (1.4)
• WordPress Plugin Exit Popups & Onsite Retargeting by OptiMonk Cross-Site Scripting (1.2.5)
• WordPress 4.1.x Arbitrary File Deletion Vulnerability (4.1 - 4.1.23)