CVE-2024-32690

CVE-2024-32690 affects the WordPress RSS Feed Widget by Fahad Mahmood. The issue is a Stored XSS vulnerability in input handling during web page generation, as described in the initial document and echoed by Red Hat/ENISA entries. Affected versions are the plugin from unknown start through 2.9.7....

CVE-2024-32690 WordPress RSS Feed Widget plugin <= 2.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7...

WordPress plugin RSS Feed Widget 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-32690: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7...

WordPress RSS Feed Widget plugin <= 2.9.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin RSS Feed Widget versions = 2.9.7...

WordPress RSS Feed Widget Plugin <= 2.9.7 is vulnerable to Cross Site Scripting (XSS)

Software RSS Feed Widget Type Plugin Vulnerable versions = 2.9.7 Fixed in 2.9.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32690 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 730c04b1b99e Credits Joshua Chan Required privilege...

CVE-2023-6805

CVE-2023-6805 affects RSS Aggregator by Feedzy (WordPress). It allows Blind SSRF via fetch_feed, enabling authenticated users withContributor+ to reach arbitrary external/internal locations and modify internal data. Fixed in 4.4.7 (contributor) and 4.4.8 (author); remediation is to upgrade to the...

CVE-2023-6805 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

WordPress RSS Aggregator by Feedzy plugin <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF) vulnerability

AuthenticatedContributor+ Blind Server-Side Request Forgery SSRF vulnerability discovered by Colin Xu in WordPress Plugin Feedzy versions = 4.4.7...

WordPress Plugin feedzy-rss-feeds 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress RSS Aggregator by Feedzy Plugin <= 4.4.7 is vulnerable to Server Side Request Forgery (SSRF)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.4.7 Fixed in 4.4.8 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-6805 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID b683d6b9d5c6 Credits Colin Xu...

CVE-2023-6805: Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

CVE-2024-23192

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

CVE-2024-23192

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

CVE-2024-23192

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

CVE-2024-23192

CVE-2024-23192 concerns Open-Xchange App Suite (Ox App Suite): RSS feeds containing malicious data- attributes can be abused to inject script code into a user’s browser session when reading compromised RSS feeds or luring users to compromised accounts. The root cause is the presence of harmful at...

CVE-2024-23192: Improper Neutralization of Input During Web Page Generation

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

CVE-2024-31292 WordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a through 2.1.5...

CVE-2024-31292 WordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a through 2.1.5...

CVE-2023-6877 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping on...