CVE-2025-14745: RSS Aggregator Plugin XSS Vulnerability

CVE-2025-14745 Overview

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's wp-rss-aggregator shortcode in all versions up to, and including, 5.0.10. This vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with contributor-level privileges can inject persistent malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, and administrative account compromise.

Affected Products

• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions up to and including 5.0.10
• WordPress sites utilizing the wp-rss-aggregator shortcode functionality
• Any WordPress installation with contributor-level or higher user accounts using the affected plugin

Discovery Timeline

• 2026-01-23 - CVE CVE-2025-14745 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-14745

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability originates in the Renderer.php file within the RSS Aggregator plugin's core component. The plugin fails to properly sanitize and escape user-supplied attributes when processing the wp-rss-aggregator shortcode. When a contributor or higher-privileged user creates or edits content containing this shortcode with malicious attributes, the unsanitized input is stored in the database and subsequently rendered without proper output encoding.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a common weakness pattern in web applications where user input is incorporated into dynamically generated pages without adequate validation or escaping.

Root Cause

The root cause lies in the Renderer.php file, specifically around line 209, where shortcode attributes are processed and rendered. The plugin accepts user-controlled input through shortcode attributes but fails to implement proper sanitization routines before storing the data and adequate escaping functions before outputting the content to the browser. This allows attackers to craft shortcode attributes containing JavaScript payloads that persist in the WordPress database and execute when pages are viewed.

Attack Vector

The attack requires network access and authentication with at least contributor-level privileges. An attacker can exploit this vulnerability by creating a WordPress post or page containing the wp-rss-aggregator shortcode with carefully crafted malicious attributes. When other users, including administrators, view the page containing the injected shortcode, the malicious script executes in their browser context.

The stored nature of this XSS vulnerability means the payload persists across multiple page views and can affect any user who accesses the compromised content. Attackers could leverage this to steal session cookies, redirect users to phishing sites, modify page content, or perform actions on behalf of authenticated users.

Detection Methods for CVE-2025-14745

Indicators of Compromise

• Unexpected or obfuscated JavaScript code within posts or pages using the wp-rss-aggregator shortcode
• Suspicious shortcode attributes containing special characters like <, >, ", ', or encoded variants
• User reports of unexpected browser behavior, redirects, or popup alerts when viewing RSS feed content
• Unauthorized modifications to user accounts or site settings following content views

Detection Strategies

• Review WordPress posts and pages containing wp-rss-aggregator shortcodes for anomalous attribute values
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor WordPress audit logs for contributor-level users creating or modifying content with shortcodes
• Deploy web application firewall (WAF) rules to detect XSS patterns in shortcode attributes

Monitoring Recommendations

• Enable comprehensive logging for content creation and modification events in WordPress
• Configure real-time alerts for JavaScript execution from unexpected sources using browser security headers
• Regularly audit shortcode usage across the WordPress installation for signs of tampering
• Monitor network traffic for data exfiltration patterns that may indicate active XSS exploitation

How to Mitigate CVE-2025-14745

Immediate Actions Required

• Update the RSS Aggregator plugin to a version newer than 5.0.10 that includes the security fix
• Review and audit all existing content containing wp-rss-aggregator shortcodes for malicious payloads
• Consider temporarily disabling the shortcode functionality until the patch is applied
• Review contributor and author user accounts for signs of compromise or unauthorized activity

Patch Information

The vulnerability has been addressed in the plugin's codebase. The fix involves implementing proper input sanitization and output escaping for shortcode attributes in the Renderer.php file. Organizations should update to the patched version immediately. Technical details of the fix can be reviewed in the WordPress Plugin Changeset Log. Additional vulnerability analysis is available from Wordfence.

Workarounds

• Restrict contributor-level access to trusted users only until the plugin is updated
• Implement server-side filtering to strip potentially dangerous attributes from shortcodes
• Deploy a Web Application Firewall (WAF) with XSS protection rules targeting shortcode parameters
• Add Content Security Policy headers to mitigate the impact of any successful XSS exploitation

# WordPress .htaccess CSP header configuration
<IfModule mod_headers.c>
    Header set Content-Security-Policy "script-src 'self'; object-src 'none';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>