{
 "id": "WPSEC-2026-2237",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2237/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2237/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2237/index.md",
 "title": "RSS Feed Widget <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting via Feed Item Titles",
 "description": "The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSS feed item titles in all versions up to, and including, 3.0.3, due to insufficient output escaping when the widget writes the feed item title into the title attribute of the item heading (unescaped, or passed only through addslashes()). This makes it possible for unauthenticated attackers who control or compromise a feed that the site is configured to display to inject arbitrary web scripts in pages that will execute whenever a user accesses a page showing the feed.",
 "plugin": {
  "slug": "rss-feed-widget",
  "name": "RSS Feed Widget",
  "full_name": "RSS Feed Widget",
  "wordpress_org": "https://wordpress.org/plugins/rss-feed-widget/",
  "advisories_url": "https://wpsec.com/vuln/plugin/rss-feed-widget/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/rss-feed-widget"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.0",
 "remediation": "Update to 4.0.0 or later.",
 "fix_released": "2026-10-30T12:16:23+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:55.070348+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2237/",
  "https://plugins.svn.wordpress.org/rss-feed-widget/tags/4.0.0/",
  "https://wordpress.org/plugins/rss-feed-widget/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/rss-feed-widget",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}