CVE Database /
CVE-2021-24988
CVE · Medium
CVE-2021-24988 — WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator] < 4.20
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24988
|
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator] < 4.20 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 4.20
|
4.20 |
2021-11-29 |
—
|
CVE-2021-24988
The WP RSS Aggregator plugin before version 4.19.3 contains a stored cross-site scripting vulnerability in its System Info admin dashboard. The flaw exists because the wprss_dismiss_addon_notice AJAX action lacks proper authorization and CSRF protection, permitting any authenticated user including subscribers to execute it and inject malicious code through the addon parameter. The plugin fails to properly sanitize and escape this data before displaying it, allowing the stored XSS payload to execute when the dashboard is viewed.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings