Threats tagged 'ghsa-w5vj-jg6p-r8hm'

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'item_title' parameter parsed from feed item titles. This affects all versions up to and including 5.2.13. An attacker can inject malicious scripts into pages viewed by users if an administrator has configured a Feed-to-Post import with a malicious feed URL. The vulnerability arises from insufficient input sanitization and output escaping.