CVE-2014-2274

Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.

• CWE-352

• https://security.dxw.com/advisories/stored-xss-and-csrf-vulnerabilities-in-subscribe-to-comments-reloaded-140129/Exploit, Third Party Advisory
• https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developersThird Party Advisory
• https://security.dxw.com/advisories/stored-xss-and-csrf-vulnerabilities-in-subscribe-to-comments-reloaded-140129/Exploit, Third Party Advisory
• https://wordpress.org/plugins/subscribe-to-comments-reloaded/#developersThird Party Advisory

Published

Mar 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2265Rock Lobster Contact Form 7 before 3.7.2 allows remote attac…
• CVE-2014-2268views/Index.php in the Install module in vTiger 6.0 before S…
• CVE-2014-2269modules/Users/ForgotPassword.php in vTiger 6.0 before Securi…
• CVE-2014-2270softmagic.c in file before 5.17 and libmagic allows context-…
• CVE-2014-2271cn.wps.moffice.common.beans.print.CloudPrintWebView in Kings…8.1
• CVE-2014-2273The hx170dec device driver in Huawei P2-6011 before V100R001…
• CVE-2014-2276The FileUploadController servlet in EMC Connectrix Manager C…
• CVE-2014-2277The make_temporary_filename function in perltidy 20120701-1 …7.1
• CVE-2014-2278Unrestricted file upload vulnerability in op/op.AddFile2.php…
• CVE-2014-2279Multiple directory traversal vulnerabilities in SeedDMS (for…
• CVE-2014-2280Cross-site scripting (XSS) vulnerability in the search featu…
• CVE-2014-2281The nfs_name_snoop_add_name function in epan/dissectors/pack…