RSS Aggregator by Feedzy < 4.3.3 - Author+ Stored Cross-Site Scripting

2024-01-1200:00:00

wpscan.com

cross-site scripting

stored

vulnerable

admin settings

input sanitization

output escaping

author-level permissions

web scripts

authentication

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.