Plugin icon

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging

wp-rss-aggregator

Vulnerabilities:

12

Last Updated:

March 3, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-03-06
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 5.0.12 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage
Fixed in
Fixed in 5.0.12
CVSS
6.1 (medium)
Published
2026-02-16
Title
RSS Aggregator < 5.0.11 - Reflected Cross-Site Scripting via 'template' Parameter
Fixed in
Fixed in 5.0.11
CVSS
7.2 (high)
Published
2026-01-22
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 5.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode
Fixed in
Fixed in 5.0.11
CVSS
6.4 (medium)
Published
2026-01-15
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 5.0.11 - Reflected Cross-Site Scripting via className
Fixed in
Fixed in 5.0.11
CVSS
6.1 (medium)
Published
2024-10-22
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 4.23.13 - Missing Authorization
Fixed in
Fixed in 4.23.13
CVSS
4.3 (medium)
Published
2024-07-15
Title
WP RSS Aggregator < 4.23.12 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
Fixed in
Fixed in 4.23.12
CVSS
4.3 (medium)
Published
2024-05-14
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 4.23.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.23.9
CVSS
6.1 (medium)
Published
2024-02-06
Title
WP RSS Aggregator < 4.23.6 - Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source
Fixed in
Fixed in 4.23.6
CVSS
3.8 (low)
Published
2024-01-25
Title
WP RSS Aggregator < 4.23.5 - Admin+ Stored XSS
Fixed in
Fixed in 4.23.5
CVSS
4.4 (medium)
Published
2022-01-26
Title
WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.20
CVSS
6.1 (medium)
Published
2021-11-29
Title
WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.19.3
CVSS
8.0 (high)
Published
2021-11-01
Title
WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.19.2
CVSS
3.5 (low)