CVE Database /
CVE-2023-6877
CVE · Medium
CVE-2023-6877 — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.3.4
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-6877
|
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.3.4 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 4.3.4
|
4.3.4 |
2024-04-06 |
—
|
CVE-2023-6877
The Feedzy RSS Aggregator plugin through version 4.3.3 contains a stored cross-site scripting vulnerability in its shortcode implementation, caused by inadequate sanitization and escaping of the Content-Type field in error messages displayed when an RSS feed fails to load. Attackers with contributor-level permissions or higher can inject malicious scripts that persist and execute for any user viewing the affected page. The vulnerability was fixed in version 4.3.4.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings