WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 5.6.0 - Unauthenticated Stored Cross-Site Scripting via Feed Source Name
- ID
- WPSEC-2026-2458
- Plugin
- WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content (wp-rss-aggregator)
- Affected
- from 4.15 before 5.7.0
- Remediation
- Update to 5.7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More on WPSec AttackSurface
- Fix released
- Published
Description
The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the feed source name in all versions up to, and including, 5.6.0, due to missing output escaping of the source name in Displays when the 'link source' option is enabled. That option is on by default. The source name can come from the remote feed's title: the onboarding wizard fills it in from the feed title, and items whose source is missing fall back to the feed title. This makes it possible for unauthenticated attackers who control a subscribed feed to inject arbitrary web scripts into front-end feed displays and shortcodes. The scripts run whenever a user views an affected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2458/
- https://plugins.svn.wordpress.org/wp-rss-aggregator/tags/5.7.0/
- https://wordpress.org/plugins/wp-rss-aggregator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS