The vulnerability allows a DOM‑Based Cross‑Site Scripting (XSS) attack in the RSS Aggregator WordPress plugin. Attackers can send crafted postMessage payloads to the plugin’s admin page without any origin validation. An unauthenticated visitor can trick an administrator into opening a malicious website that posts a message containing JavaScript, which the plugin then executes in the administrator’s browser context. Successful exploitation lets the attacker execute arbitrary code with the administrator’s privileges, potentially resulting in theft of authentication cookies, account takeover, and full site compromise.

All installations of the RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress running version 5.0.11 or earlier are affected. The flaw resides in the plugin’s JavaScript that is widely deployed across WordPress sites, leaving administrators on these version states vulnerable.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure a legitimate administrator to a malicious site that can post a message; hence social engineering is a critical component of the attack vector. Once the victim interacts, the injected JavaScript runs with full administrative context, making the potential damage considerable.