The WP RSS Aggregator plugin by rebelcode suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via the RSS feed source, which are then stored and executed in the context of users viewing the injected pages. This vulnerability affects multi-site WordPress setups and installations with unfiltered_html disabled, present in all plugin versions up to 4.23.4. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An attacker with administrator-level access on affected WordPress installations can inject malicious scripts into pages via the RSS feed source. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking, defacement, or other script-based attacks. The impact is limited to multi-site environments or where unfiltered_html is disabled, reducing the overall attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully control access to administrator accounts and consider disabling or restricting the use of the vulnerable plugin in multi-site environments or where unfiltered_html is disabled. Monitoring for plugin updates from rebelcode is recommended to apply any forthcoming patches promptly.