The Silencesoft RSS Reader plugin for WordPress contains a cross‑site request forgery flaw on the 'sil_rss_edit_page' action because it either omits or incorrectly validates the nonce. An attacker can craft a request that, when a site administrator follows a malicious link or otherwise triggers the page, will delete an existing RSS feed without the administrator’s knowledge or consent. The vulnerability enables loss of content and can disrupt the service that the feeds provide.

WordPress sites using any version of the Silencesoft RSS Reader plugin up to and including 0.6 are affected. Administrators of these sites are at risk when they access the feed editing page.

The CVSS base score of 4.3 indicates a moderate severity level, and the EPSS probability is reported as less than 1%, showing that real‑world exploitation is unlikely but still possible. The vulnerability is not listed in CISA's KEV catalog, yet public advisories are available. Attack requires only a socially engineered click by an administrator on a maliciously crafted link. Without a vendor fix the risk remains while the affected version remains in use.