DOM-Based Cross-Site Scripting Vulnerability in RSS Aggregator Plugin for WordPress
CVE-2026-2433

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Rss Aggregator – Rss Import, News Feeds, Feed To Post, And Autoblogging
Vendor
CVE Published:
7 March 2026

What is CVE-2026-2433?

The RSS Aggregator plugin for WordPress is susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue arises from the plugin's management of a global message event listener without proper origin validation and the direct handling of user-controlled URLs via 'window.open()'. As a result, attackers can exploit this weakness to execute arbitrary JavaScript within the context of an administrator's session, potentially leading to significant security breaches. Administrators may unknowingly be tricked into accessing malicious sites that send crafted postMessage payloads, compromising the integrity of their session.

Affected Version(s)

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging 0 <= 5.0.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-rss-aggrega...
https://plugins.trac.wordpress.org/browser/wp-rss-aggrega...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio
.