Vulnerability · Published Feb 28, 2022 · Assigned by WPScan
CVE-2022-0189WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS)
Medium 6.1
In plain English
A medium-severity cross-site scripting in WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)2.2%top 17.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More | 4.20 – before 4.20 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2659298 x_refsource_CONFIRM