CVE-2025-14375

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14375", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T18:52:33.809Z", "datePublished": "2026-01-16T07:23:09.745Z", "dateUpdated": "2026-04-08T16:47:38.674Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:38.674Z"}, "affected": [{"vendor": "rebelcode", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018className\u2019 parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2dde13-2940-478e-8e2b-baf60003754a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "timeline": [{"time": "2025-12-10T11:26:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-15T19:09:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T13:47:36.732451Z", "id": "CVE-2025-14375", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:48:29.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T13:47:36.732451Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:48:17.889Z"}}], "cna": {"title": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className", "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "rebelcode", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.0.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-10T11:26:28.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-15T19:09:57.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2dde13-2940-478e-8e2b-baf60003754a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018className\u2019 parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-16T07:23:09.745Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14375", "state": "PUBLISHED", "dateUpdated": "2026-01-16T13:48:29.591Z", "dateReserved": "2025-12-09T18:52:33.809Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T07:23:09.745Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "vendor": "rebelcode", "versions": [{"lessThanOrEqual": "5.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018className\u2019 parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin RSS Aggregator \u2013 RSS Import, News Feeds, Feed a Post, and Autoblogging para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s del par\u00e1metro 'className' en todas las versiones hasta la 5.0.10, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto posibilita que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14375", "lastModified": "2026-06-17T08:35:49.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14375", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T13:47:36.732451Z", "version": "2.0.3"}}]}, "published": "2026-01-16T08:15:46.050", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2dde13-2940-478e-8e2b-baf60003754a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T23:58:39.851763+00:00", "value": {"mitigation_remediation": ["Upgrade the RSS Aggregator plugin to a version that contains the proper input sanitization and output escaping fixes.", "If an upgrade cannot be performed immediately, deactivate or delete the RSS Aggregator plugin until the patch is applied.", "As a temporary defense, configure a content\u2011security\u2011policy that restricts script execution to trusted origins to mitigate possible XSS effects."], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Scripting (Reflected XSS)"}, "threat_synthesis": {"affected_systems": "WordPress sites running the RebelCode RSS Aggregator plugin, all versions up to and including 5.0.10. The vulnerability is present in every release within that range.", "description_and_impact": "The RSS Aggregator plugin for WordPress allows unauthenticated attackers to inject arbitrary scripts into pages via the className parameter. Because the plugin fails to properly sanitize or escape this input, crafted URLs can deliver malicious JavaScript that executes when a user follows the link. This vulnerability aligns with CWE\u201179 and can lead to session hijacking, defacement, or data exfiltration on the victim\u2019s behalf.", "risk_and_exploitability": "The CVSS score is 6.1, indicating a moderate severity. The EPSS score of less than 1\u202f% suggests that exploitation is unlikely under current conditions, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits are known. Attackers would need to entice users to click a malicious link containing a malicious className value; authentication is not required. The low EPSS makes it a modest risk, but XSS can be highly damaging depending on the content served and the value of user data on the target site."}}}}, "created": "2026-01-16T13:41:34.679587+00:00", "updated": "2026-04-22T00:00:03.957730+00:00", "vendors": ["rebelcode", "rebelcode$PRODUCT$rss_aggregator", "wordpress", "wordpress$PRODUCT$wordpress"]}