CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-9835 – RSS Feed Widget < 3.0.1 - Reflected XSS
https://notcve.org/view.php?id=CVE-2024-9835
22 Oct 2024 — The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers The RSS Feed Widget plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary ... • https://wpscan.com/vulnerability/0277b060-805d-4b85-b5a4-fa93a731cd8d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-9836 – RSS Feed Widget < 3.0.0 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-9836
22 Oct 2024 — The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rfw-youtube-videos' shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization an... • https://wpscan.com/vulnerability/f87af54e-3e58-4c29-8a30-e7d52234c9d4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •