648 matches found
CVE-2024-38703: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9...
CVE-2024-6621
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprssactivatefeedsource' and 'wprsspausefeedsource' functions in all versions up to, and including, 4.23.11...
CVE-2024-6621 WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprssactivatefeedsource' and 'wprsspausefeedsource' functions in all versions up to, and including, 4.23.11...
CVE-2024-6621
CVE-2024-6621 affects the WordPress plugin “WP RSS Aggregator” (RSS Import, News Feeds, Feed to Post, Autoblogging). The vulnerability is due to a missing capability check in the functions wprss_activate_feed_source and wprss_pause_feed_source, allowing authenticated attackers with Subscriber-lev...
CVE-2024-6621 WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprssactivatefeedsource' and 'wprsspausefeedsource' functions in all versions up to, and including, 4.23.11...
WordPress WP RSS Aggregator plugin <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update vulnerability
Missing Authorization to Authenticated Subscriber+ Feed State Update vulnerability discovered by Peter Thaleikis in WordPress Plugin WP RSS Aggregator versions = 4.23.11...
CVE-2024-6621: Missing Authorization
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprssactivatefeedsource' and 'wprsspausefeedsource' functions in all versions up to, and including, 4.23.11...
WordPress WP RSS Aggregator Plugin <= 4.23.11 is vulnerable to Broken Access Control
Software WP RSS Aggregator Type Plugin Vulnerable versions = 4.23.11 Fixed in 4.23.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6621 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2954812636fe Credits Peter Thaleikis Required...
WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin WP Event Aggregator versions = 1.7.9...
WordPress WP Event Aggregator Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)
Software WP Event Aggregator Type Plugin Vulnerable versions = 1.7.9 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38703 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 070e26b00886 Credits Manab Jyoti Dowarah Required...
Liferea: Remote Code Execution
Background Liferea is a feed reader/news aggregator that brings together all of the content from your favorite subscriptions into a simple interface that makes it easy to organize and browse feeds. Its GUI is similar to a desktop mail/news client, with an embedded web browser. Description A...
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 4.23.9 - Reflected Cross-Site Scripting
Description The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noticeid' parameter in all versions up to, and including, 4.23.8 due to insufficient input sanitization and output escaping. This...
CVE-2024-4860
The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...
CVE-2024-4860
The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...
CVE-2024-4860
CVE-2024-4860 affects the WordPress plugin RSS Aggregator (WP RSS Aggregator) for versions < 4.23.9. The issue is a Cross‑Site Scripting (XSS) vulnerability caused by insufficient sanitization of the notice_id GET parameter. Connected sources confirm the detail and note the specific affected r...
CVE-2024-4860
The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...
WordPress plugin RSS Aggregator 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2024-33160 · WordPress · Wordpress Rss Aggregator
Name of the Vulnerable Software and Affected Versions: WordPress RSS Aggregator versions prior to 4.23.9 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. This vulnerability is caused by the lack of sanitization of the notice id GET parameter. Recommendations: For...
CVE-2024-4860: Improper Neutralization of Input During Web Page Generation
The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...
CVE-2023-6805 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...