Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Wprssaggregator Clear all filters
TI-2024-00585 CVE-2024-0630 · GHSA-xrq6-qp2x-fh89

WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source

Priority LOW 22

The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RSS feed source in all versions up to, and including, 4.23.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00381 Published 2024-02-05 No fix listed CWE-79
TI-2022-00128 CVE-2022-0189 · GHSA-mfv7-34v2-2q9m

WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS)

Priority LOW 32

The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Sit…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02228 Published 2022-02-28 Fixed in 4.20 CWE-79
TI-2021-07267 CVE-2021-24988 · GHSA-gp23-wr4g-cj6r

WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting

Priority LOW 24

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00302 Published 2021-12-27 Fixed in 4.19.3 CWE-79
TI-2021-07050 CVE-2021-24768 · GHSA-4q83-54pp-rmxj

WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capabili…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-11-29 Fixed in 4.19.2 CWE-79