The RSS Aggregator plugin for WordPress is vulnerable to reflected cross‑site scripting through the 'template' parameter because the input is not properly sanitized or escaped before being output. An attacker who can craft a malicious request can cause a victim browser to execute arbitrary JavaScript when the user visits a page containing the injected code. This flaw exposes the site to potential data theft, session hijacking, defacement, or the execution of further malicious payloads by the victim’s browser. The weakness is identified as CWE‑79, indicating a failure to filter or escape user‑ supplied data before rendering it in a browser environment.

Rebelcode’s RSS Aggregator plugin, all versions up to and including 5.0.10, is affected. The flaw exists in the core file DisplaysStore.php and can be exploited on any WordPress site that has an outdated instance of this plugin.

The CVSS score is 7.2, indicating a high severity of the vulnerability. The EPSS score is less than 1 %, suggesting a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to entice a user to click a specially crafted link that includes the malicious 'template' value; authentication is not required for exploitation. Because the flaw is in a publicly exposed URL parameter, it can be triggered by any visitor who follows the compromised link, making it readily exploitable if the context is compelling.