Threats tagged 'ghsa-8cxh-vg66-rqhx'

The RSS Aggregator by Feedzy WordPress plugin (up to version 5.2.12) is vulnerable to stored cross-site scripting (XSS) via the media:group/media:description XML element in imported feeds. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. Exploitation requires an administrator to configure a feed import pointing to a malicious feed URL and trigger the import through the plugin's standard workflow.