CVE-2026-2433mediumCWE-79

CVE-2026-2433: falha de média gravidade em rebelcode RSS Aggregator – RSS Import, News…

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.2%
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registering a global message event listener without origin validation (missing event.origin check) and directly passing user-controlled URLs to window.open() without URL scheme validation. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by tricking them into visiting a malicious website that sends crafted postMessage payloads to the plugin's admin page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
rebelcode · RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
CVEs relacionadas — rebelcode RSS Aggregator – RSS Import, News…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-9583MEDIUMRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing AuthorizationEPSS 0.4%CVE-2024-6621MEDIUMWP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State UpdateEPSS 0.4%CVE-2024-0630MEDIUMWP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed SourceEPSS 0.4%CVE-2026-1216HIGHRSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' ParameterEPSS 0.3%CVE-2025-14745MEDIUMRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator ShortcodeEPSS 0.3%CVE-2025-14375MEDIUMRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via classNameEPSS 0.2%