# WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 5.6.0 - Unauthenticated Stored Cross-Site Scripting via Feed Source Name

- **ID:** WPSEC-2026-2458
- **Plugin:** WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content (`wp-rss-aggregator`), https://wordpress.org/plugins/wp-rss-aggregator/
- **Affected versions:** from 4.15 before 5.7.0
- **Fixed in:** 5.7.0 (Update to 5.7.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-rss-aggregator
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2458/

## Description

The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the feed source name in all versions up to, and including, 5.6.0, due to missing output escaping of the source name in Displays when the 'link source' option is enabled. That option is on by default. The source name can come from the remote feed's title: the onboarding wizard fills it in from the feed title, and items whose source is missing fall back to the feed title. This makes it possible for unauthenticated attackers who control a subscribed feed to inject arbitrary web scripts into front-end feed displays and shortcodes. The scripts run whenever a user views an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2458/
- https://plugins.svn.wordpress.org/wp-rss-aggregator/tags/5.7.0/
- https://wordpress.org/plugins/wp-rss-aggregator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2458/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.