Threats tagged 'ghsa-cr3r-cx3j-65fh'

The FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored cross-site scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization function only removes the 'target' attribute and does not strip potentially dangerous 'style' or event-handler attributes. Additionally, the plugin disables WordPress's default content filters before saving imported feed items, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users view the injected content.