The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/f87af54e-3e58-4c29-8a30-e7d52234c9d4/ | Exploit Third Party Advisory |
Configurations
History
15 May 2025, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| First Time |
Rss Feed Widget Project
Rss Feed Widget Project rss Feed Widget |
|
| References | () https://wpscan.com/vulnerability/f87af54e-3e58-4c29-8a30-e7d52234c9d4/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:rss_feed_widget_project:rss_feed_widget:*:*:*:*:*:wordpress:*:* |
Information
Published : 2024-11-12 06:15
Updated : 2025-05-15 16:32
NVD link : CVE-2024-9836
Mitre link : CVE-2024-9836
CVE.ORG link : CVE-2024-9836
JSON object : View
Products Affected
rss_feed_widget_project
- rss_feed_widget
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')