# RSS Feed Widget <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting via Feed Item Titles

- **ID:** WPSEC-2026-2237
- **Plugin:** RSS Feed Widget (`rss-feed-widget`), https://wordpress.org/plugins/rss-feed-widget/
- **Affected versions:** all versions before 4.0.0
- **Fixed in:** 4.0.0 (Update to 4.0.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rss-feed-widget
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2237/

## Description

The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSS feed item titles in all versions up to, and including, 3.0.3, due to insufficient output escaping when the widget writes the feed item title into the title attribute of the item heading (unescaped, or passed only through addslashes()). This makes it possible for unauthenticated attackers who control or compromise a feed that the site is configured to display to inject arbitrary web scripts in pages that will execute whenever a user accesses a page showing the feed.

## References

- https://wpsec.com/vuln/WPSEC-2026-2237/
- https://plugins.svn.wordpress.org/rss-feed-widget/tags/4.0.0/
- https://wordpress.org/plugins/rss-feed-widget/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2237/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.