CVE-2024-9835

The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2024-9835

creationtimestamp| type| source ---|---|--- 2024-11-12 06:06:53+00:00| seen| https://infosec.exchange/users/cve/statuses/113468480736175719 2024-11-12 08:00:09+00:00| seen| https://t.me/cvedetector/10586...

CVE-2024-9835

The RSS Feed Widget WordPress plugin, specifically versions prior to 3.0.1 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to escape the $_SERVER['REQUEST_URI'] parameter before it is outputted back into an attribute. This vulnerability could allow an attac...

CVE-2024-9835 RSS Feed Widget < 3.0.1 - Reflected XSS

The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2024-9835 RSS Feed Widget < 3.0.1 - Reflected XSS

The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...