CVE-2025-14745

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14745", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-15T20:32:38.308Z", "datePublished": "2026-01-23T05:29:51.482Z", "dateUpdated": "2026-04-08T17:27:58.203Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:58.203Z"}, "affected": [{"vendor": "rebelcode", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd201949-d3a1-4fdb-bf98-252fbfd59380?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/src/Renderer.php#L209"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator/trunk/core/src/Renderer.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-12-15T20:48:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-22T17:08:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T15:57:24.821715Z", "id": "CVE-2025-14745", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T16:00:16.846Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T15:57:24.821715Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T16:00:13.052Z"}}], "cna": {"title": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "rebelcode", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.0.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-15T20:48:02.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-22T17:08:48.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd201949-d3a1-4fdb-bf98-252fbfd59380?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/src/Renderer.php#L209"}, {"url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator/trunk/core/src/Renderer.php"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-23T05:29:51.482Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14745", "state": "PUBLISHED", "dateUpdated": "2026-01-23T16:00:16.846Z", "dateReserved": "2025-12-15T20:32:38.308Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-23T05:29:51.482Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "vendor": "rebelcode", "versions": [{"lessThanOrEqual": "5.0.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post y Autoblogging para WordPress es vulnerable a Stored cross-site scripting a trav\u00e9s del shortcode 'wp-rss-aggregator' del plugin en todas las versiones hasta la 5.0.10, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-14745", "lastModified": "2026-06-17T08:36:29.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14745", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T15:57:24.821715Z", "version": "2.0.3"}}]}, "published": "2026-01-23T06:15:50.030", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/src/Renderer.php#L209"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3439384/wp-rss-aggregator/trunk/core/src/Renderer.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd201949-d3a1-4fdb-bf98-252fbfd59380?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:01:13.001973+00:00", "value": {"mitigation_remediation": ["Upgrade the RSS Aggregator plugin to the latest version (5.0.11 or later) to remove the unsanitized shortcode handling. ", "If an upgrade cannot be performed immediately, disable or remove the wp\u2011rss\u2011aggregator shortcode from the content and ensure it cannot be inserted by contributors. ", "Restrict contributor role capabilities so that they cannot edit or create content containing the shortcode, or implement an additional sanitization layer such as a content filtering plugin to strip script tags from shortcode attributes."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting via plugin shortcode"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to all releases of the Rebelcode RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin up to and including version 5.0.10. WordPress sites running a WordPress installation and any contained plugin installation of this plugin version are impacted.", "description_and_impact": "The RSS Aggregator plugin for WordPress is affected by a Stored Cross\u2011Site Scripting vulnerability, classified as CWE\u201179, that allows an authenticated user with contributor-level access to inject arbitrary JavaScript into pages via the wp\u2011rss\u2011aggregator shortcode. This flaw is the result of insufficient input sanitization and output escaping of shortcode attributes, enabling the attacker to execute scripts whenever a user loads the affected page. Consequently, the attacker can deface content, steal session cookies, or perform other client\u2011side attacks against site visitors.", "risk_and_exploitability": "The CVSS score for this flaw is moderate at 6.4 and the EPSS score is less than 1%, indicating a low probability of observed exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must first obtain contributor or higher access on the WordPress site and then use the plugin\u2019s shortcode editor to insert malicious code via the shortcode attributes. Successful exploitation would occur when a visitor views a page that contains the compromised shortcode. No additional network exposure or remote code execution is required, but the impact can be significant for end\u2011users."}}}}, "created": "2026-01-23T10:26:42.583829+00:00", "updated": "2026-04-20T21:15:20.620705+00:00", "vendors": ["rebelcode", "rebelcode$PRODUCT$rss_aggregator", "wordpress", "wordpress$PRODUCT$wordpress"]}