CVE-2026-2825: WeRSS we-mp-rss XSS Vulnerability

CVE-2026-2825 Overview

CVE-2026-2825 is a stored cross-site scripting (XSS) vulnerability in rachelos WeRSS we-mp-rss through version 1.4.8. The flaw resides in the fix_html function within tools/fix.py, part of the Article Module. Attackers can inject malicious script content that is rendered without proper sanitization. Exploitation requires network access and low privileges, with limited integrity impact and no confidentiality or availability impact [CWE-79]. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against unpatched WeRSS instances.

Critical Impact
Authenticated attackers can inject persistent JavaScript through the Article Module, which executes in the context of users who view affected article content.

Affected Products

rachelos WeRSS we-mp-rss versions up to and including 1.4.8
The fix_html function in tools/fix.py
The Article Module component of WeRSS

Discovery Timeline

2026-02-20 - CVE-2026-2825 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2825

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue in the WeRSS Article Module. The fix_html function in tools/fix.py processes HTML content from articles but fails to neutralize attacker-controlled script payloads. When the processed content is later rendered to a user's browser, the injected script executes in the application's origin.

Because the payload is stored, every user who views the affected article triggers execution. This enables session theft, forced actions on behalf of victims, and pivoting to administrative functionality if a privileged user views the content. Exploitation is remote and requires only low-privileged access plus user interaction to view the article. See the Notion blog XSS analysis and VulDB entry #346950 for technical details.

Root Cause

The root cause is improper neutralization of input during web page generation in fix_html. The function processes article HTML without enforcing an allowlist on tags and attributes. Event handler attributes and <script> elements survive the sanitization routine and reach the rendered DOM.

Attack Vector

An authenticated attacker submits article content containing HTML or JavaScript payloads through the Article Module. The fix_html routine stores the content with malicious markup intact. Any subsequent viewer triggers script execution within the WeRSS application context, allowing the attacker to steal cookies, perform actions as the victim, or deface rendered content.

No verified exploit code is published. Refer to the VulDB CTI record for additional vector details.

Detection Methods for CVE-2026-2825

Indicators of Compromise

Article records in the WeRSS database containing <script> tags, javascript: URIs, or HTML event handlers such as onerror, onload, or onclick.
Outbound HTTP requests from user browsers to attacker-controlled domains shortly after viewing WeRSS articles.
Unexpected session cookie or token exfiltration patterns originating from clients that recently accessed WeRSS.

Detection Strategies

Inspect stored article content in WeRSS for HTML elements and attributes outside an expected allowlist.
Monitor web server logs for article submission requests containing encoded script payloads or unusual character sequences.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on WeRSS pages.

Monitoring Recommendations

Forward WeRSS application and access logs to a centralized analytics platform for query-based hunting of XSS payload patterns.
Alert on administrator accounts viewing newly created or modified articles from low-privileged authors.
Track browser console errors and CSP violation reports tied to WeRSS hostnames.

How to Mitigate CVE-2026-2825

Immediate Actions Required

Upgrade WeRSS we-mp-rss to a release later than 1.4.8 once the maintainer publishes a fix.
Restrict article creation privileges to trusted accounts until a patched version is deployed.
Audit existing article records and remove entries containing script tags, event handler attributes, or javascript: URIs.

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Monitor the VulDB submission #753879 and the WeRSS project repository for fix availability. Apply the corrected fix_html implementation as soon as it is released.

Workarounds

Place WeRSS behind a web application firewall with rules that block HTML event handlers and <script> tags in article submission parameters.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Disable or restrict the Article Module if it is not required for operational use.

bash

# Example restrictive CSP header for the WeRSS application
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";