Not rated
CVE-2022-0189 The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the…
Description
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More 4.20 | earliest → < 4.20 | 4.20 |