Lucene search
Krzysztof ZającWPVDB-ID:52A71BF1-B8BC-479E-B741-EB8FB9685014HistoryJan 26, 2022 - 12:00 a.m.
WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS)
2022-01-2600:00:00
Krzysztof Zając
wpscan.com
12
0.001 Low
EPSS
Percentile
41.6%
The plugin does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
PoC
Save the HTML below to a file with the .html extension, then open it in Firefox, while being authenticated in a separate tab to a WordPress site with the plugin installed.
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-rss-aggregator | lt | 4.20 |
Related
patchstack
patchstack
cnvd
cnvd
WordPress WP RSS Aggregator plugin cross-site scripting vulnerability
2022-03-02 00:00:00
prion
prion
Cross site scripting
2022-02-28 09:15:00
nuclei
nuclei
WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting
2022-03-27 14:25:03
nvd
nvd
CVE-2022-0189
2022-02-28 09:15:08
cve
cve
CVE-2022-0189
2022-02-28 09:15:08
cvelist
cvelist
wpexploit
wpexploit
WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS)
2022-01-26 00:00:00