The RSS Aggregator plugin for WordPress allows unauthenticated attackers to inject arbitrary scripts into pages via the className parameter. Because the plugin fails to properly sanitize or escape this input, crafted URLs can deliver malicious JavaScript that executes when a user follows the link. This vulnerability aligns with CWE‑79 and can lead to session hijacking, defacement, or data exfiltration on the victim’s behalf.

WordPress sites running the RebelCode RSS Aggregator plugin, all versions up to and including 5.0.10. The vulnerability is present in every release within that range.

The CVSS score is 6.1, indicating a moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely under current conditions, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits are known. Attackers would need to entice users to click a malicious link containing a malicious className value; authentication is not required. The low EPSS makes it a modest risk, but XSS can be highly damaging depending on the content served and the value of user data on the target site.