GCVE - cpe:2.3:a:rebelcode:rss_aggregator:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rebelcode:rss_aggregator:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Rebelcode (`9c9f9b21-1cca-5afe-ad71-8498f7e913d2`)
Product	Rss Aggregator (`530659cc-019f-5b1a-9d30-f6c541b226e2`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-9583`	vulnerable	2026-06-08 07:00:28.258524	RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization MEDIUM (4.3) The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprss_ajax_send_premium_support function in all versions up to, and including, 4.23.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send premium support requests with an attacker-controlled subject line and email address to support allowing them to impersonate the site owner. License information may also be leaked. Published: 2024-10-23T06:45:05.657Z Updated: 2026-04-08T16:36:25.173Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/126c77fa-11c5-431f-8fc9-0375ed6c8a91?source=cve https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/admin-help.php#L274 https://plugins.trac.wordpress.org/changeset/3168468/wp-rss-aggregator/trunk/includes/admin-help.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6621`	vulnerable	2026-06-08 06:58:20.027506	WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update MEDIUM (4.3) The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprss_activate_feed_source' and 'wprss_pause_feed_source' functions in all versions up to, and including, 4.23.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or pause existing RSS feeds. Published: 2024-07-16T11:00:58.101Z Updated: 2026-04-08T17:06:17.989Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/8e37331b-0b75-41ee-b390-532efd674cc1?source=cve https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php#L12 https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php#L28 https://plugins.trac.wordpress.org/browser/wp-rss-aggregator/trunk/includes/feed-states.php?rev=3118231	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4860`	vulnerable	2026-06-08 06:50:18.811479	Details available MEDIUM (5.4) The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the 'notice_id' GET parameter. Published: 2024-05-14T09:11:39.233Z Updated: 2024-08-01T20:55:10.115Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2024-16	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.