CVE-2021-24988CWE-79

WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting

published December 27, 2021

CVSS
—
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00302 · 21.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-27T10:33Z
EPSS history
Timeline
  • 27 DEC 10:33Z
    WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting
    cvelistv5