CVE-2025-14375: WordPress RSS Aggregator XSS Vulnerability

CVE-2025-14375 Overview

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the className parameter in all versions up to, and including, 5.0.10. This vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user is tricked into performing an action such as clicking on a malicious link.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of authenticated WordPress administrators.

Affected Products

• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions up to and including 5.0.10
• WordPress installations using vulnerable versions of the WP RSS Aggregator plugin

Discovery Timeline

• 2026-01-16 - CVE CVE-2025-14375 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-14375

Vulnerability Analysis

This Reflected Cross-Site Scripting (XSS) vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability exists in the RSS Aggregator plugin's handling of the className parameter, where user-supplied input is reflected back to the page without proper sanitization or encoding.

When a user accesses a specially crafted URL containing malicious JavaScript in the className parameter, the plugin fails to properly sanitize this input before including it in the rendered HTML output. This allows the injected script to execute within the context of the victim's browser session on the WordPress site.

The attack requires user interaction—specifically, the victim must click on a malicious link crafted by the attacker. Once clicked, the malicious payload executes with the same privileges as the logged-in user, which could include WordPress administrators with full site access.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the RSS Aggregator plugin's codebase. The className parameter is accepted from user input and directly reflected in the page output without being passed through WordPress's built-in escaping functions such as esc_attr() or esc_html(). This oversight allows specially crafted input containing HTML entities and JavaScript code to be interpreted by the browser as executable code rather than plain text.

Attack Vector

The attack vector is network-based and requires no authentication to exploit. An attacker crafts a malicious URL containing JavaScript payload within the className parameter and distributes this link to potential victims through phishing emails, social media, compromised websites, or other delivery mechanisms.

When a victim with an active WordPress session clicks the malicious link, the injected JavaScript executes in their browser context. The script can then perform actions such as:

• Stealing session cookies or authentication tokens
• Performing administrative actions on behalf of the victim
• Modifying page content or redirecting users to malicious sites
• Capturing keystrokes or form data

The attack is particularly effective against WordPress administrators, as their elevated privileges allow the injected script to make site-wide changes, create new admin accounts, or install malicious plugins.

Detection Methods for CVE-2025-14375

Indicators of Compromise

• Unusual URL parameters containing encoded JavaScript or HTML tags in WordPress access logs, particularly targeting RSS Aggregator plugin endpoints
• Web server logs showing requests with suspicious className parameter values containing script tags or event handlers
• Reports from users of unexpected browser behavior or redirects when using the WordPress site
• Anti-malware or browser security tools flagging suspicious scripts on WordPress pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing XSS payloads in the className parameter
• Monitor WordPress access logs for URL patterns indicative of XSS attack attempts, such as <script>, javascript:, or encoded variants
• Deploy browser-based XSS protection mechanisms and Content Security Policy (CSP) headers to limit script execution
• Use WordPress security plugins that scan for and alert on XSS vulnerabilities in installed plugins

Monitoring Recommendations

• Enable detailed logging for the RSS Aggregator plugin and related WordPress endpoints
• Configure SIEM rules to alert on high volumes of requests with unusual query string patterns
• Implement real-time monitoring for JavaScript errors or unexpected script execution on WordPress pages
• Regularly review WordPress audit logs for unauthorized administrative actions that could indicate post-exploitation activity

How to Mitigate CVE-2025-14375

Immediate Actions Required

• Update the RSS Aggregator plugin to a version newer than 5.0.10 that contains the security fix
• Review WordPress access logs for evidence of exploitation attempts targeting the className parameter
• Implement a Web Application Firewall (WAF) rule to filter XSS payloads if immediate patching is not possible
• Educate site administrators about the risks of clicking suspicious links while authenticated

Patch Information

The vulnerability has been addressed by the plugin developers. Security researchers can review the specific code changes in the WordPress Plugin Changeset 3439384. Additional technical details are available in the Wordfence Vulnerability Report.

Site administrators should update to the latest version of the RSS Aggregator plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

Workarounds

• Temporarily disable the RSS Aggregator plugin until a patched version can be applied
• Implement strict Content Security Policy (CSP) headers to prevent inline script execution
• Configure WAF rules to block requests containing potentially malicious values in the className parameter
• Restrict administrative access to trusted IP addresses to reduce the attack surface

# Example CSP header configuration for Apache
# Add to .htaccess or server configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"