Rss Feed Widget

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:rss_feed_widget_project:rss_feed_widget:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

VendorRss Feed Widget Project (18034c78-54b2-5a9d-9bbe-dfdccd0dedc9)
ProductRss Feed Widget (f730012b-60bb-51d3-b27b-cb12c02ef703)
Edition*
Language*
Software edition*
Target softwarewordpress
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/wp-plugins/rss-feed-widget purl2cpe 2026-06-01 10:16:16.827939
pkg:github/wpplugins/rss-feed-widget purl2cpe 2026-06-01 10:16:16.827941

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-9836 vulnerable 2026-06-08 07:00:28.754684 RSS Feed Widget < 3.0.0 - Contributor+ Stored XSS
The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published: 2024-11-12T06:00:04.726Z
Updated: 2024-11-12T14:28:45.998Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24314 vulnerable 2026-06-08 05:22:32.784385 Details available
Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Published: 2020-08-26T12:59:49.000Z
Updated: 2024-08-04T15:12:08.963Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.