6.4
Moyenne
CVE-2025-14745 The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored…
Description
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging 5.0 | premières → 5.0.10 | Pas de correctif indiqué |
Autres CVE de RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
Les 7 CVE de RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging →
CVE-2026-2433
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to…
6.1
Moyenne
CVE-2026-1216
The RSS Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'template' parameter…
7.2
Élevée
CVE-2025-14375
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to…
6.1
Moyenne
CVE-2024-9583
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to…
4.3
Moyenne