CVE-2014-100007: Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote...

Security readout for executives and security teams

This CVE affects the HK Exif Tags WordPress plugin before 1.12. An authenticated user could place script or HTML into image EXIF metadata, which may run in another user's browser when the plugin displays it. The available sources do not show active exploitation or a CVSS score. Exposure is likely limited to WordPress sites running HK Exif Tags before version 1.12, especially where non-administrative authenticated users can upload or influence images with EXIF metadata. Treat as a targeted WordPress plugin exposure rather than an emergency internet-wide vulnerability. Prioritize remediation if the plugin exists on public or business-critical sites, particularly where many authenticated users can upload content. Mitigation focus: Upgrade HK Exif Tags to version 1.12 or later where available.; Disable or remove the plugin if it is not required.; Restrict image upload and content-editing permissions until remediation is verified..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.