Reflected XSS Vulnerability in RSS Feed Widget Plugin by WordPress
CVE-2020-24314

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Rss Feed Widget
Vendor
CVE Published:
26 August 2020

What is CVE-2020-24314?

The RSS Feed Widget Plugin for WordPress, in versions 2.7.9 and earlier, is vulnerable to reflected Cross-Site Scripting (XSS). This occurs because the plugin fails to properly sanitize the 't' GET parameter before displaying it in an input field. Attackers can exploit this vulnerability by crafting malicious URLs that, when accessed by users, can execute arbitrary scripts in the context of their browsers. This not only compromises user data but may also lead to further attacks on the website.

References

https://zeroaptitude.com/zerodetail/wordpress-plugin-bug-...
x_refsource_MISC
https://wordpress.org/plugins/rss-feed-widget/advanced/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.