Launchpad.net

CVE 2015-9415

The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.

See the CVE page on Mitre.org for more details.