Is WP RSS Aggregator safe?

No known vulnerability affects the current version (5.7.0). 13 issues were found in earlier versions and fixed, the latest disclosed on Mar 6, 2026.

Checked 2 days ago against the WPVulnerability database, for version 5.7.0.

How it’s looked after

Last release: Nov 3, 2026 (5 days ago)
Releases in the last year: 14
Tested up to: WordPress 7.1.4
Support resolved: 4 of 4 threads in two months
Active installs: 40K+

13 known vulnerabilities

9 medium
1 low
3 not rated

None affects the current version.

Disclosed each year

20141
20212
20221
20245
20264

Every known vulnerability in WP RSS Aggregator

Newest first, with any that affect the current version at the top.

Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage
Fixed in 5.0.12 · CVE-2026-2433 · Mar 6, 2026 · Wordfence
Reflected Cross-Site Scripting via 'template' Parameter
Fixed in 5.0.11 · CVE-2026-1216 · Feb 16, 2026 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode
Fixed in 5.0.11 · CVE-2025-14745 · Jan 22, 2026 · Wordfence
medium
Reflected Cross-Site Scripting via className
Fixed in 5.0.11 · CVE-2025-14375 · Jan 15, 2026 · Wordfence
medium
Missing Authorization
Fixed in 4.23.13 · CVE-2024-9583 · Oct 22, 2024 · Wordfence
medium
Missing Authorization to Authenticated (Subscriber+) Feed State Update
Fixed in 4.23.12 · CVE-2024-6621 · Jul 15, 2024 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 4.23.9 · CVE-2024-4860 · May 14, 2024 · Wordfence
low
Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source
Fixed in 4.23.6 · CVE-2024-0628 · Feb 6, 2024 · Wordfence
medium
Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source
Fixed in 4.23.5 · CVE-2024-0630 · Jan 25, 2024 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 4.20 · CVE-2022-0189 · Jan 26, 2022 · Wordfence
medium
Subscriber+ Stored Cross-Site Scripting
Fixed in 4.20 · CVE-2021-24988 · Nov 29, 2021 · Wordfence
medium
Admin+ Stored Cross-Site Scripting
Fixed in 4.20 · CVE-2021-24768 · Nov 1, 2021 · Wordfence
Authorization Bypass
Fixed in 4.6.4 · Dec 16, 2014 · Wordfence

Questions about WP RSS Aggregator’s security

Is WP RSS Aggregator safe to use?

No known vulnerability affects its current version. Earlier versions had issues that are now fixed, so keep WP RSS Aggregator updated: most attacks target sites that haven’t updated.

Does WP RSS Aggregator have known security vulnerabilities?

None that affect the current version. WPVulnerability’s database lists 13 older issues, fixed in earlier versions, so keep WP RSS Aggregator up to date.

Is WP RSS Aggregator still maintained?

Yes. Its last release was 5 days ago. Its authors resolved 4 of the 4 support threads opened in the last two months.

Is WP RSS Aggregator compatible with the latest WordPress?

Yes. It’s tested up to WordPress 7.1.4, the current version.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.