The rebelcode RSS Aggregator plugin for WordPress, versions up to and including 5.0.11, contains a DOM-based XSS vulnerability due to improper input neutralization in its admin-shell.js. Specifically, the plugin registers a global message event listener without verifying the origin of incoming postMessage events, and it passes user-controlled URLs directly to window.open() without validating the URL scheme. This flaw enables unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by luring them to a malicious site that sends crafted postMessage payloads to the plugin's admin page. The vulnerability is tracked as CVE-2026-2433 with a CVSS 3.1 score of 6.1 (medium severity). No known exploits in the wild or patch information is currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code within the context of an authenticated administrator's session. This can lead to partial compromise of confidentiality and integrity (e.g., theft of admin session data or manipulation of admin interface content). Availability is not impacted. The attack requires the administrator to visit a malicious website that sends crafted postMessage payloads to the vulnerable plugin page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid visiting untrusted websites while logged into WordPress with this plugin installed. Monitoring vendor channels for updates or patches is recommended.