WordPress WP RSS Aggregator plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation’s suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions of the WordPress WP RSS Aggregator plugin prior to 4.20, which stems from the plugin’s failure to output the id parameter of the wprss_fetch_items_row_action AJAX operation back to the response before outputting it back to the response, it is not cleaned up and escaped, and an attacker can use this vulnerability to cause reflected cross-site scripting.