rachelos WeRSS We-MP-RSS Cross-Site Scripting Vulnerability
Vulnerability
A stored cross-site scripting vulnerability has been identified in rachelos WeRSS we-mp-rss versions through 1.4.8. The issue arises in the Article Module, specifically within the fix_html function of tools/fix.py. This vulnerability allows authenticated users to inject malicious scripts that are stored and executed later, potentially leading to unauthorized actions or data exposure.
Impact
Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.
Added: Feb 20, 2026, 7:32 AM
Updated: Feb 20, 2026, 1:56 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
1.7exploitability
6.3remediation
0.0relevance
3.0threat
6.4urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.