CVE-2026-2433

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2433", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T21:50:01.000Z", "datePublished": "2026-03-07T07:22:04.098Z", "dateUpdated": "2026-04-08T16:45:01.018Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:01.018Z"}, "affected": [{"vendor": "rebelcode", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registering a global message event listener without origin validation (missing event.origin check) and directly passing user-controlled URLs to window.open() without URL scheme validation. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by tricking them into visiting a malicious website that sends crafted postMessage payloads to the plugin's admin page."}], "title": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/311960e7-c4b4-4638-980f-1e08ffa621ba?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L58"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L58"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L153"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L153"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3473511%40wp-rss-aggregator%2Ftrunk&old=3439393%40wp-rss-aggregator%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-12T22:05:34.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-06T19:00:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T17:31:34.331517Z", "id": "CVE-2026-2433", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:28:59.710Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T17:31:34.331517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T17:31:35.355Z"}}], "cna": {"title": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "rebelcode", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.0.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-12T22:05:34.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-06T19:00:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/311960e7-c4b4-4638-980f-1e08ffa621ba?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L58"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L58"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L153"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L153"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3473511%40wp-rss-aggregator%2Ftrunk&old=3439393%40wp-rss-aggregator%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registering a global message event listener without origin validation (missing event.origin check) and directly passing user-controlled URLs to window.open() without URL scheme validation. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by tricking them into visiting a malicious website that sends crafted postMessage payloads to the plugin's admin page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:01.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2433", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:01.018Z", "dateReserved": "2026-02-12T21:50:01.000Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-07T07:22:04.098Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "vendor": "rebelcode", "versions": [{"lessThanOrEqual": "5.0.11", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registering a global message event listener without origin validation (missing event.origin check) and directly passing user-controlled URLs to window.open() without URL scheme validation. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by tricking them into visiting a malicious website that sends crafted postMessage payloads to the plugin's admin page."}, {"lang": "es", "value": "El plugin RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post y Autoblogging para WordPress es vulnerable a cross-site scripting basado en DOM a trav\u00e9s de postMessage en todas las versiones hasta la 5.0.11, inclusive. Esto se debe a que el archivo admin-shell.js del plugin registra un oyente de eventos de mensaje global sin validaci\u00f3n de origen (falta la comprobaci\u00f3n de event.origin) y pasa directamente URLs controladas por el usuario a window.open() sin validaci\u00f3n del esquema de URL. Esto hace posible que atacantes no autenticados ejecuten JavaScript arbitrario en el contexto de la sesi\u00f3n de un administrador autenticado al enga\u00f1arlos para que visiten un sitio web malicioso que env\u00eda cargas \u00fatiles postMessage manipuladas a la p\u00e1gina de administraci\u00f3n del plugin."}], "id": "CVE-2026-2433", "lastModified": "2026-06-17T10:30:56.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2433", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T17:31:34.331517Z", "version": "2.0.3"}}]}, "published": "2026-03-07T08:16:11.193", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L153"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/tags/5.0.10/core/js/admin-shell.js#L58"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L153"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/core/js/admin-shell.js#L58"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3473511%40wp-rss-aggregator%2Ftrunk&old=3439393%40wp-rss-aggregator%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/311960e7-c4b4-4638-980f-1e08ffa621ba?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.11]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging", "source": "cna", "vendor": "rebelcode"}, "product": "rss_aggregator_\u2013_rss_import,_news_feeds,_feed_to_post,_and_autoblogging", "vendor": "rebelcode"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T19:51:06.978597+00:00", "value": {"mitigation_remediation": ["Upgrade the RSS Aggregator plugin to version 5.0.12 or later, which includes the fix for the DOM\u2011Based XSS flaw.", "If an immediate upgrade is not possible, restrict access to the WordPress admin area using IP whitelisting or enable two\u2011factor authentication to reduce exposure to social\u2011engineering attempts by attackers.", "Configure a content\u2011security\u2011policy header that disallows execution of inline scripts or prevents untrusted origins from sending postMessage to the admin page, thereby mitigating the XSS vector while the plugin is still on an affected version."], "summary": {"action": "Patch", "impact": "DOM-Based Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of the RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress running version 5.0.11 or earlier are affected. The flaw resides in the plugin\u2019s JavaScript that is widely deployed across WordPress sites, leaving administrators on these version states vulnerable.", "description_and_impact": "The vulnerability allows a DOM\u2011Based Cross\u2011Site Scripting (XSS) attack in the RSS Aggregator WordPress plugin. Attackers can send crafted postMessage payloads to the plugin\u2019s admin page without any origin validation. An unauthenticated visitor can trick an administrator into opening a malicious website that posts a message containing JavaScript, which the plugin then executes in the administrator\u2019s browser context.\nSuccessful exploitation lets the attacker execute arbitrary code with the administrator\u2019s privileges, potentially resulting in theft of authentication cookies, account takeover, and full site compromise.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog.\nExploitation requires an attacker to lure a legitimate administrator to a malicious site that can post a message; hence social engineering is a critical component of the attack vector. Once the victim interacts, the injected JavaScript runs with full administrative context, making the potential damage considerable."}}}}, "created": "2026-03-09T10:05:41.715811+00:00", "updated": "2026-04-15T20:00:06.613397+00:00", "vendors": ["rebelcode", "rebelcode$PRODUCT$rss_aggregator_\u2013_rss_import,_news_feeds,_feed_to_post,_and_autoblogging", "wordpress", "wordpress$PRODUCT$wordpress"]}