WordPress plugin
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 13 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium11
- Low1
All WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.1 | Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage ≤5.0.11Update to 5.0.12 | CVE-2026-2433 | |
| High7.2 | Reflected Cross-Site Scripting via 'template' Parameter ≤5.0.10Update to 5.0.11 | CVE-2026-1216 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode ≤5.0.10Update to 5.0.11 | CVE-2025-14745 | |
| Medium6.1 | Reflected Cross-Site Scripting via className ≤5.0.10Update to 5.0.11 | CVE-2025-14375 | |
| Medium4.3 | Missing Authorization ≤4.23.12Update to 4.23.13 | CVE-2024-9583 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Feed State Update ≤4.23.11Update to 4.23.12 | CVE-2024-6621 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤4.23.8Update to 4.23.9 | CVE-2024-4860 | |
| Low3.8 | Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source 4.23.5 – 4.23.5Update to 4.23.6 | CVE-2024-0628 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source ≤4.23.4Update to 4.23.5 | CVE-2024-0630 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤4.19.3Update to 4.20 | CVE-2022-0189 | |
| Medium5.4 | Subscriber+ Stored Cross-Site Scripting <4.19.3Update to 4.19.3 | CVE-2021-24988 | |
| Medium4.8 | Admin+ Stored Cross-Site Scripting ≤4.19.1Update to 4.19.2 | CVE-2021-24768 | |
| Medium6.5 | Authorization Bypass ≤4.6.3Update to 4.6.4 | — |
- Medium6.1Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage
≤5.0.11Update to 5.0.12
- High7.2Reflected Cross-Site Scripting via 'template' Parameter
≤5.0.10Update to 5.0.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode
≤5.0.10Update to 5.0.11
- Medium6.1Reflected Cross-Site Scripting via className
≤5.0.10Update to 5.0.11
- Medium4.3Missing Authorization
≤4.23.12Update to 4.23.13
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Feed State Update
≤4.23.11Update to 4.23.12
- Medium6.1Reflected Cross-Site Scripting
≤4.23.8Update to 4.23.9
- Low3.8Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source
4.23.5 – 4.23.5Update to 4.23.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source
≤4.23.4Update to 4.23.5
- Medium6.1Reflected Cross-Site Scripting
≤4.19.3Update to 4.20
- Medium5.4Subscriber+ Stored Cross-Site Scripting
<4.19.3Update to 4.19.3
- Medium4.8Admin+ Stored Cross-Site Scripting
≤4.19.1Update to 4.19.2
- Medium6.5Authorization Bypass
≤4.6.3Update to 4.6.4
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content: common questions
Does WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content: 1 high, 11 medium, 1 low. None are known to affect version null.
How do I check which version of WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content vulnerability?
CVE-2026-2433, published Mar 6, 2026: RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage. Severity: Medium (CVSS 6.1).
Is any WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content vulnerability listed in CISA KEV?
No. None of the known WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content vulnerabilities is currently listed in the CISA KEV catalog.