CVE-2022-4667 - RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS · CoreCVE

Back Back to CVE browser

MEDIUM

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

Published Jan 30, 2023

5.4

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Affected products

Vendor n/a Product RSS Aggregator by Feedzy Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

RSS Aggregator by Feedzy

unaffected

Version	Status	Constraints
0	affected	<4.1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://wpscan.com/vulnerability/a388232b-a399-46a5-83e6-20c1b5df351d
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/a388232b-a399-46a5-83e6-20c1b5df351d		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jan 30, 2023

Updated Mar 27, 2025

Reserved Dec 23, 2022

Link CVE-2022-4667

CISA Vulnrichment

Updated Mar 27, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2022-4667

Severity n/a

Public date n/a

Links CVE-2022-4667