RokMicroNews <= 1.5 - Multiple Vulnerabilities

The RokMicroNews plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.5 due to inclusion of a vulnerable version of TimThumb. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser. The plugin is also vulnerable to Arbitrary File Upload, Denial of Service Attacks, and Full Path Disclosure. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible, deny availability to legitimate users, and read sensitive information such as the full path of the WordPress installation.