Vulnerability · Published Dec 27, 2021 · Assigned by WPScan

CVE-2021-24988WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting

Medium 5.4

In plain English

A medium-severity cross-site scripting in WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.3%top 76.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More	4.19.3 – before 4.19.3

Weakness: CWE-79

References

https://wpscan.com/vulnerability/0742483b-6314-451b-a63a-536fd1e14845 x_refsource_MISC