Skip to content
Sign in
Not rated

CVE-2021-24768 The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field,…

Description

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.

Affected products and versions

Product Affected versions Fixed in
WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More 4.19 earliest → < 4.19.2 4.19.2

Other CVEs of WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More

The 3 CVEs of WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More →
CVE-2022-0189 The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the… Not rated CVE-2021-24988 The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the… Not rated
Track this CVE