2 results (0.002 seconds)
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-9836 – RSS Feed Widget < 3.0.0 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-9836
The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. • https://wpscan.com/vulnerability/f87af54e-3e58-4c29-8a30-e7d52234c9d4 •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-9835 – RSS Feed Widget < 3.0.1 - Reflected XSS
https://notcve.org/view.php?id=CVE-2024-9835
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers • https://wpscan.com/vulnerability/0277b060-805d-4b85-b5a4-fa93a731cd8d •