Technical impact
Silencesoft RSS Reader plugin version 0.6 or earlier contains a stored cross‑site scripting flaw. The issue arises because user‑supplied input is not properly escaped before rendering on web pages, enabling an attacker to inject malicious JavaScript that will execute whenever a victim visits the affected page. This vulnerability can lead to defacement, credential theft, or other client‑side compromise for any user who views the affected content. The weakness is identified as CWE‑79.
Affected Systems
The vulnerability exists in the Silencesoft RSS Reader plugin for WordPress, through all versions up to and including 0.6. The plugin is commonly deployed on websites that aggregate external RSS feeds, and the issue is present regardless of the specific WordPress version in use.
Risk and Exploitability
The CVSS score of 5.9 places this flaw in the medium severity range, and the EPSS score of less than 1% indicates a very low current exploitation likelihood. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be web‑based, requiring the attacker to supply crafted input that the plugin stores in the database and later renders unsanitized on a page viewed by unsuspecting users. Exploitation would likely involve posting a malicious RSS item or editing a feed item that the plugin displays.
