Skip to content
OpenAdvisories

Vendor

rebelcode

10 known vulnerabilities.

rebelcode at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities February 2026: 1 vulnerability March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202610
Apr 202600
Mar 202610
Feb 202610
Jan 202620
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202510
Jan 202500
Dec 202400

Products

RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging 7 Spotlight Social Media Feeds 2 Spotlight Social Feeds – Block, Shortcode, and Widget 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 6.1
    CVE-2024-13362

    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

    bPlugins webfactory unitecms nicheaddons Web / CMS
  • Medium 6.1
    CVE-2026-2433

    RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage

    The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registeri…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • High 7.2
    CVE-2026-1216

    RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter

    The RSS Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'template' parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This make…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 6.4
    CVE-2025-14745

    RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode

    The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 6.1
    CVE-2025-14375

    RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className

    The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization …

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 5.3
    CVE-2025-26758

    WordPress Spotlight Social Feeds plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds spotlight-social-photo-feeds allows Retrieve Embedded Sensitive Data.This issue affects Spotlight Social Media Feeds: from n/a t…

    rebelcode Spotlight Social Media Feeds
  • Medium 4.3
    CVE-2024-9583

    RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization

    The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprss_ajax_send_premium_support function in all versions up to, and in…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 4.3
    CVE-2024-6621

    WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update

    The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprss_activate_feed_source' and 'wprss_pause_feed_source' functions i…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 4.3
    CVE-2024-31381

    WordPress Spotlight Social Feeds plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in RebelCode Spotlight Social Media Feeds.This issue affects Spotlight Social Media Feeds: from n/a through 1.6.10.

    rebelcode Spotlight Social Media Feeds
  • Medium 4.4
    CVE-2024-0630

    WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source

    The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RSS feed source in all versions up to, and including, 4.23.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS