What’s Vulnerable › Vulnerabilities

CVE-2021-25055: FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-21 · updated 2026-06-17
• Weakness: CWE-79

Description

The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.

Affected products

• radgeek FeedWordPress: before 2022.0123 — fixed in 2022.0123

How to fix

Upgrade to a fixed version: radgeek FeedWordPress 2022.0123. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2662665
• https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571
• https://plugins.trac.wordpress.org/changeset/2662665
• https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571

Get alerted when CVE-2021-25055 or the next vulnerability affects your stack