{
 "id": "WPSEC-2026-2459",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2459/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2459/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2459/index.md",
 "title": "WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 5.6.0 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Content",
 "description": "The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed item content in all versions up to, and including, 5.6.0, due to insufficient sanitization of feed item HTML before it is saved as post content. The importer decodes HTML entities in the item content after the feed parser has cleaned it, then saves the result. WordPress applies KSES on save only when the current user lacks the unfiltered_html capability, so imports run by such a user, such as a manual import started by an administrator, store the remote HTML without filtering. This makes it possible for unauthenticated attackers who control an RSS feed the site subscribes to to inject arbitrary web scripts into imported posts. The scripts run whenever a user views those posts.",
 "plugin": {
  "slug": "wp-rss-aggregator",
  "name": "WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More",
  "full_name": "WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content",
  "wordpress_org": "https://wordpress.org/plugins/wp-rss-aggregator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-rss-aggregator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-rss-aggregator"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.0.0",
    "from_inclusive": true,
    "to": "5.7.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.0.0 before 5.7.0"
  ]
 },
 "introduced_in": "5.0.0",
 "fixed_in": "5.7.0",
 "remediation": "Update to 5.7.0 or later.",
 "fix_released": "2026-11-03T09:27:48+00:00",
 "published": "2026-11-04T09:46:28+00:00",
 "updated": "2026-11-03T13:19:47.481237+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2459/",
  "https://plugins.svn.wordpress.org/wp-rss-aggregator/tags/5.7.0/",
  "https://wordpress.org/plugins/wp-rss-aggregator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-rss-aggregator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}