DOM-Based Cross-Site Scripting Vulnerability in RSS Aggregator Plugin for WordPress

CVE-2026-2433

What is CVE-2026-2433?

The RSS Aggregator plugin for WordPress is susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue arises from the plugin's management of a global message event listener without proper origin validation and the direct handling of user-controlled URLs via 'window.open()'. As a result, attackers can exploit this weakness to execute arbitrary JavaScript within the context of an administrator's session, potentially leading to significant security breaches. Administrators may unknowingly be tricked into accessing malicious sites that send crafted postMessage payloads, compromising the integrity of their session.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References