Rss Feed Widget (Androidbubble) - vulnerabilities (CVEs)

2 CVEs, 0 in the last 30 days, 53 known versions, newest CVE from 2024-11-12. Vendor: Androidbubble.

CVEs of Rss Feed Widget

• CVE-2024-9836 - CVSS 5.9 (medium), 2024-11-12: The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post…
• CVE-2024-9835 - CVSS 4.8 (medium), 2024-11-12: The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could…