The RSS Aggregator plugin for WordPress contains a Reflected Cross-Site Scripting flaw that permits unauthenticated attackers to execute malicious scripts within a user session.

This vulnerability is a Reflected Cross-Site Scripting flaw (CWE-79) caused by insufficient input sanitization and output escaping on the template parameter. Unauthenticated attackers can exploit this by crafting malicious links that execute arbitrary JavaScript when clicked by a victim.

Successful exploitation allows attackers to execute arbitrary web scripts in the context of an authenticated user session. This can lead to unauthorized actions, session hijacking, or the theft of sensitive user data, potentially resulting in significant reputational harm and loss of data integrity. With a CVSS score of 7.2, the vulnerability is considered High severity due to the potential for unauthenticated remote exploitation.

Immediate Action: Check the WordPress plugin repository for an update beyond version 5.0.10 and apply it immediately; if no update is available, deactivate the plugin until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous URL patterns containing script tags or suspicious query parameters directed at the plugin endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust cross-site scripting protection rules to detect and block malicious payloads targeting the template parameter.

Public Exploit Available: Unknown

Given the High severity rating and the ease of exploitation, organizations using the RSS Aggregator plugin must prioritize remediation. Administrators should verify the current installation version and apply the latest security patches provided by the vendor. If a patch is not yet available, disabling the plugin is the only effective way to eliminate the risk of script injection until the vendor provides a resolution.