Stored Cross-Site Scripting Vulnerability in Taeggie Feed Plugin for WordPress

CVE-2025-6382

What is CVE-2025-6382?

The Taeggie Feed plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to improper handling of user input. Specifically, the plugin’s render() method directly incorporates user-supplied input from the name attribute into a tag without necessary escaping. This flaw allows authenticated attackers with contributor-level or greater access to inject malicious scripts, potentially compromising the security of users who visit affected pages.

References