Stored Cross-Site Scripting in RSS Aggregator Plugin for WordPress
CVE-2025-14745

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Rss Aggregator – Rss Import, News Feeds, Feed To Post, And Autoblogging
Vendor
CVE Published:
23 January 2026

What is CVE-2025-14745?

The RSS Aggregator plugin for WordPress suffers from a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit inadequate input sanitization and output escaping. By manipulating the 'wp-rss-aggregator' shortcode, attackers can inject arbitrary web scripts into pages, compromising user security as these scripts are executed whenever a user visits the affected pages.

Affected Version(s)

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging 0 <= 5.0.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-rss-aggrega...
https://plugins.trac.wordpress.org/changeset/3439384/wp-r...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Djaidja Moundjid
.