6.1

CVE-2026-2433

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registering a global message event listener without origin validation (missing event.origin check) and directly passing user-controlled URLs to window.open() without URL scheme validation. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by tricking them into visiting a malicious website that sends crafted postMessage payloads to the plugin's admin page.
Mögliche Gegenmaßnahme
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content: Update to version 5.0.12, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerrebelcode
≫
Produkt RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
Default Statusunaffected
Version <= 5.0.11
Version 0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
Version *-5.0.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.11
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.wordfence.com/threat-intel/vulnerabilities/id/311960e7-c4b4-4638-980f-1e08ffa621ba?source=cve
https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L58
https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L58
https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L153
https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L153
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3473511%40wp-rss-aggregator%2Ftrunk&old=3439393%40wp-rss-aggregator%2Ftrunk&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/311960e7-c4b4-4638-980f-1e08ffa621ba
Third Party Advisory