{
 "id": "WPSEC-2026-2458",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2458/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2458/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2458/index.md",
 "title": "WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 5.6.0 - Unauthenticated Stored Cross-Site Scripting via Feed Source Name",
 "description": "The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the feed source name in all versions up to, and including, 5.6.0, due to missing output escaping of the source name in Displays when the 'link source' option is enabled. That option is on by default. The source name can come from the remote feed's title: the onboarding wizard fills it in from the feed title, and items whose source is missing fall back to the feed title. This makes it possible for unauthenticated attackers who control a subscribed feed to inject arbitrary web scripts into front-end feed displays and shortcodes. The scripts run whenever a user views an affected page.",
 "plugin": {
  "slug": "wp-rss-aggregator",
  "name": "WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More",
  "full_name": "WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content",
  "wordpress_org": "https://wordpress.org/plugins/wp-rss-aggregator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-rss-aggregator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-rss-aggregator"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.15",
    "from_inclusive": true,
    "to": "5.7.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.15 before 5.7.0"
  ]
 },
 "introduced_in": "4.15",
 "fixed_in": "5.7.0",
 "remediation": "Update to 5.7.0 or later.",
 "fix_released": "2026-11-03T09:27:48+00:00",
 "published": "2026-11-04T09:46:28+00:00",
 "updated": "2026-11-03T13:19:47.481237+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2458/",
  "https://plugins.svn.wordpress.org/wp-rss-aggregator/tags/5.7.0/",
  "https://wordpress.org/plugins/wp-rss-aggregator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-rss-aggregator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}