Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: fahadmahmood Component: Rss Feed Widget Clear all filters
TI-2024-09127 CVE-2024-9835 · GHSA-hw6j-ph25-g43c

RSS Feed Widget < 3.0.1 - Reflected XSS

Priority MEDIUM 55

The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0033 Published 2024-11-12 Fixed in 3.0.1 CWE-79
TI-2024-09331 CVE-2024-10057 · GHSA-58r3-hw64-gmg3

RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode

Priority LOW 28

The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00341 Published 2024-10-18 No fix listed CWE-79