# WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 5.6.0 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Content

- **ID:** WPSEC-2026-2459
- **Plugin:** WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content (`wp-rss-aggregator`), https://wordpress.org/plugins/wp-rss-aggregator/
- **Affected versions:** from 5.0.0 before 5.7.0
- **Fixed in:** 5.7.0 (Update to 5.7.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-rss-aggregator
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2459/

## Description

The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed item content in all versions up to, and including, 5.6.0, due to insufficient sanitization of feed item HTML before it is saved as post content. The importer decodes HTML entities in the item content after the feed parser has cleaned it, then saves the result. WordPress applies KSES on save only when the current user lacks the unfiltered_html capability, so imports run by such a user, such as a manual import started by an administrator, store the remote HTML without filtering. This makes it possible for unauthenticated attackers who control an RSS feed the site subscribes to to inject arbitrary web scripts into imported posts. The scripts run whenever a user views those posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-2459/
- https://plugins.svn.wordpress.org/wp-rss-aggregator/tags/5.7.0/
- https://wordpress.org/plugins/wp-rss-aggregator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2459/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.