CVE-2022-0189

PoC —

CVSS 3.1

6.1 medium

EPSS

2%p82

Published

Feb 28, 2022 (Feb 28, 2022)

Modified

Jun 17, 2026

Description

The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Vendors: wprssaggregator
Products: wp rss aggregator
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news0 stories

No ingested article mentions this CVE yet.