WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting

The plugin does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.

Add an URL to Blacklist (RSS Aggregator > Tools > Blacklist) with the following payload int he "URL to blacklist" field: <img/src/onerror=alert(/XSS/)>