The Blogroll Fun WordPress plugin contains a reflected cross‑site scripting flaw that allows an attacker to supply arbitrary JavaScript through the "k" query parameter in blogroll.php. The value of "k" is echoed back to the browser without any sanitization, so an attacker can craft URLs that execute malicious code in the context of any user who clicks the link. While the vulnerability does not provide direct server control, it can compromise session information, steal credentials, or redirect users to phishing sites.

The vulnerability is limited to the Blogroll Fun plugin for WordPress, version 0.8.4 and earlier, created by Jason Newman. WordPress sites running any of these versions are impacted; newer releases (0.8.5 and later) contain the fixed code.

The CVSS score of 5.1 indicates a moderate severity for client‑side injection. Because the flaw is exploitable via a public URL and requires no authentication, an attacker with network access to a vulnerable WordPress site could use the bug immediately. No exploit probabilities are provided in EPSS, and the issue is not listed in CISA’s KEV catalog. In practice, the attack vector is a simple HTTP GET request to /wp-content/plugins/blogroll-fun/blogroll.php?k=<payload>.