The rebelcode RSS Aggregator plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of user input in the 'template' parameter. This flaw exists in all versions up to and including 5.0.10. Attackers can inject arbitrary web scripts that execute when a user interacts with a maliciously crafted link. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, but with scope changed and low confidentiality and integrity impact. No known exploits in the wild or vendor patches are documented in the provided information.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary scripts in the context of a victim's browser session when the victim clicks a malicious link. This can lead to information disclosure and integrity impacts within the affected web application context. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links involving the 'template' parameter in the plugin. Consider disabling or removing the plugin if possible or applying custom input sanitization as a temporary measure.