CVE-2020-36758

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the savefeedzyposttypemeta function. This makes it possible for unauthenticated attackers to update post...

CVE-2020-36758

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the savefeedzyposttypemeta function. This makes it possible for unauthenticated attackers to update post...

Cross site request forgery (csrf)

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the savefeedzyposttypemeta function. This makes it possible for unauthenticated attackers to update post...

CVE-2020-36758 RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the savefeedzyposttypemeta function. This makes it possible for unauthenticated attackers to update post...

WordPress Plugin RSS Aggregator by Feedzy Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

CVE-2022-4667

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

Cross site scripting

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4667 RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4667

The CVE-2022-4667 entry points to the WordPress plugin RSS Aggregator by Feedzy, affected in versions prior to 4.1.1. The root cause is that certain block options are not validated or escaped before being echoed on the page, enabling Stored XSS. This could allow a user with Contributor-level or s...

PT-2023-14984 · WordPress · The Rss Aggregator By Feedzy

Name of the Vulnerable Software and Affected Versions: The RSS Aggregator by Feedzy WordPress plugin versions prior to 4.1.1 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such ...

WordPress plugin RSS Aggregator by Feedzy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 1. Add the Feedzy RS...

WordPress RSS Aggregator by Feedzy Plugin < 4.1.1 is vulnerable to Cross Site Scripting (XSS)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions 4.1.1 Fixed in 4.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4667 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cee226bbb884 Credits István Márt...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC 1. Add the Feedz...

WordPress RSS Aggregator by Feedzy plugin <= 3.4.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress RSS Aggregator by Feedzy plugin versions = 3.4.2. Solution Update the WordPress RSS Aggregator by Feedzy plugin to the latest available version at least 3.4.3...