Vulnerabilities / RSS Feed Widget / WPSEC-2026-2237
RSS Feed Widget <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting via Feed Item Titles
Medium 5.4
CWE-79Fixed in 4.0.0
- ID
- WPSEC-2026-2237
- Plugin
- RSS Feed Widget (rss-feed-widget)
- Affected
- all versions before 4.0.0
- Remediation
- Update to 4.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- RSS Feed Widget on WPSec AttackSurface
- Fix released
- Published
Description
The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSS feed item titles in all versions up to, and including, 3.0.3, due to insufficient output escaping when the widget writes the feed item title into the title attribute of the item heading (unescaped, or passed only through addslashes()). This makes it possible for unauthenticated attackers who control or compromise a feed that the site is configured to display to inject arbitrary web scripts in pages that will execute whenever a user accesses a page showing the feed.
References
- https://wpsec.com/vuln/WPSEC-2026-2237/
- https://plugins.svn.wordpress.org/rss-feed-widget/tags/4.0.0/
- https://wordpress.org/plugins/rss-feed-widget/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS