WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 5.6.0 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Content
- ID
- WPSEC-2026-2459
- Plugin
- WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content (wp-rss-aggregator)
- Affected
- from 5.0.0 before 5.7.0
- Remediation
- Update to 5.7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More on WPSec AttackSurface
- Fix released
- Published
Description
The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed item content in all versions up to, and including, 5.6.0, due to insufficient sanitization of feed item HTML before it is saved as post content. The importer decodes HTML entities in the item content after the feed parser has cleaned it, then saves the result. WordPress applies KSES on save only when the current user lacks the unfiltered_html capability, so imports run by such a user, such as a manual import started by an administrator, store the remote HTML without filtering. This makes it possible for unauthenticated attackers who control an RSS feed the site subscribes to to inject arbitrary web scripts into imported posts. The scripts run whenever a user views those posts.
References
- https://wpsec.com/vuln/WPSEC-2026-2459/
- https://plugins.svn.wordpress.org/wp-rss-aggregator/tags/5.7.0/
- https://wordpress.org/plugins/wp-rss-aggregator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS