The RSS Feed Widget WordPress plugin (fahadmahmood) contains a stored cross-site scripting vulnerability (CWE-79) in its rfw-youtube-videos shortcode. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied shortcode attributes. Authenticated users with contributor or higher privileges can exploit this to inject arbitrary scripts that execute in the context of other users viewing the affected pages. The vulnerability affects all versions up to 2.9.9. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated contributor or higher to inject malicious JavaScript that executes in the browsers of users who view the infected page. This can lead to information disclosure or session hijacking within the scope of the affected site. The vulnerability does not impact availability and requires user interaction (viewing the page). The CVSS vector indicates network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed for the script execution once injected, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the RSS Feed Widget plugin if possible. Monitor for plugin updates from the vendor addressing this vulnerability.