WordPress Plugin Vulnerabilities

RSS Feed Widget < 2.8.1 - Authenticated Cross-Site Scripting (XSS)

Description

The RSS Feed Widget WordPress plugin version 2.8.0 and below was vulnerable to Authenticated Cross-Site Scripting (XSS) within the "t" GET parameter.

Proof of Concept

Affects Plugins

Plugin icon
rss-feed-widget
Fixed in 2.8.1

References

CVE
CVE-2020-24314
URL
https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-hunting-part-1/
URL
https://plugins.trac.wordpress.org/changeset/2329461/rss-feed-widget

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.6 (medium)

Miscellaneous

Original Researcher
zerodetail & ratherbland
Verified
No
WPVDB ID
ac41b53a-4c0e-4723-8d58-8ad018b8ecd3

Timeline

Publicly Published
2020-08-10 (about 5 years ago)
Added
2020-08-26 (about 5 years ago)
Last Updated
2020-08-27 (about 5 years ago)

Other

Published
Title
Published
2024-10-31
Title
Show Visitor IP Address <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-10
Title
C9 Blocks <= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-22
Title
SEOPress – On-site SEO < 7.6 - Author+ Stored Cross-Site Scripting
Published
2025-09-10
Title
Mixtape <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-21
Title
bxSlider integration for WordPress <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting