Cross‑Site Request Forgery in the Dan Cameron Add RSS WordPress plugin can be used to perform a Stored XSS attack. An attacker who tricks an authenticated administrator into submitting a form (or visiting a crafted URL) can inject malicious JavaScript that is saved in the plugin’s data store. When any user loads the affected page, the script executes in that user’s browser, enabling session hijacking, defacement, or the execution of additional malicious payloads. This flaw is an instance of CWE‑352, a CSRF vulnerability that leads to stored cross‑site scripting.

All WordPress sites that use the Dan Cameron Add RSS plugin version 1.5 or older are affected. The vulnerability applies across all installations that have the plugin installed, from the earliest release through 1.5 inclusive.

The CVSS score of 7.1 indicates a high severity. EPSS <1% suggests a low probability of exploitation at the moment, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, exploitation requires only that a logged‑in administrator be tricked into executing a forged request, a scenario that is realistically feasible in many environments. An attacker could obtain the administrative session cookie through social engineering or compromised credentials, then submit the forged request to inject XSS, leading to compromised user sessions and potential data theft.