Skip to content
Sign in
Not rated

CVE-2021-24988 The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the…

Description

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.

Affected products and versions

Product Affected versions Fixed in
WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More 4.19 earliest → < 4.19.3 4.19.3

Other CVEs of WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More

The 3 CVEs of WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More →
CVE-2022-0189 The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the… Not rated CVE-2021-24768 The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field,… Not rated
Track this CVE