CVE-2023-6801: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6801?
CVE-2023-6801 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2023-6801?
To fix CVE-2023-6801, update the RSS Aggregator by Feedzy plugin to version 4.3.3 or later.
What are the potential impacts of CVE-2023-6801?
CVE-2023-6801 can allow an attacker to inject malicious scripts that execute in the context of the user's browser session.
Which versions of the RSS Aggregator by Feedzy are affected by CVE-2023-6801?
CVE-2023-6801 affects all versions of the RSS Aggregator by Feedzy up to and including 4.3.2.
Is user input a factor in CVE-2023-6801?
Yes, CVE-2023-6801 arises from insufficient input sanitization and output escaping in the admin settings.