CVE-2025-5015 Parsons AccuWeather Widget Cross-site Scripting

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-5015: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

PT-2025-26765 · Unknown · Custom Rss Widget +1

Name of the Vulnerable Software and Affected Versions: AccuWeather and Custom RSS widget affected versions not specified Description: A cross-site scripting issue exists in the AccuWeather and Custom RSS widget, allowing an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-49312

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a...

CVE-2025-49312

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a...

CVE-2025-49312 WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a...

CVE-2025-49312

CVE-2025-49312 – Reflected Cross-Site Scripting in the WordPress plugin CodeRevolution Echo RSS Feed Post Generator . The vulnerability arises from improper neutralization of input during web page generation, enabling a reflected XSS attack. Affected software: Echo RSS Feed Post Generator Plugin ...

WordPress plugin Echo RSS Feed Post Generator Plugin Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-25705 · WordPress · Coderevolution Echo Rss Feed Post Generator Plugin

Name of the Vulnerable Software and Affected Versions: CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress versions through 5.4.8.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for...

CVE-2025-49312: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: txgbe: fixed a memory leak in the error handling path of txgbeprobe When txgbeswinit is called, memory is allocated for wx-rsskey in wxinitrsskey. However, in the txgbeprobe function, the subsequent error handling paths d...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: ngbe: fixed a memory leak in the ngbeprobe error path. When ngbeswinit is called, memory is allocated for wx-rsskey in wxinitrsskey. However, in the ngbeprobe function, the subsequent error paths after ngbeswinit do not...

CVE-2025-31134 FreshRSS vulnerable to directory enumeration via ext.php

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server...

FreshRSS 跨站请求伪造漏洞

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. A cross-site request forgery vulnerability exists in versions of FreshRSS prior to 1.26.2, which stems from mishandling of malicious feed entries and could result in a denial of service...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by domiee13 in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.8.3...

CVE-2024-23192

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

CVE-2024-27927

RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service DoS attacks. The attacker ca...

CVE-2024-0628

The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2024-4860

The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...

CVE-2024-32690

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7...