Unknown · Verification Code For Comments · CVE-2014-4565
**Name of the Vulnerable Software and Affected Versions**
Verification Code for Comments plugin versions 2.1.0 and earlier
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML via the `vp`, `vs`, `l`, `vu`, or `vm` parameters in the vcc.js.php file. This can lead to cross-site scripting (XSS) attacks.
**Recommendations**
For Verification Code for Comments plugin versions 2.1.0 and earlier, update to a version later than 2.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the vcc.js.php file or disabling the plugin until a patch is available. Avoid using the `vp`, `vs`, `l`, `vu`, or `vm` parameters in the affected file until the issue is resolved.