Rss Feed Post Generator Echo Vulnerabilities

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 5.4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th...

CVSS:

6.1

Affected:

up to 5.4.8.1

Fixed in:

5.4.9

Disclosed:

Jun 18, 2025

CVE-2025-49312 on NVD →

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured_image() function in all versions up to, and including, 5.4.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected s...

CVSS:

9.8

Affected:

up to 5.4.8.1

Fixed in:

5.4.8.2

Disclosed:

May 16, 2025

CVE-2025-4391 on NVD →

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echo_check_post_header_sent() function. This makes it possible for unauthenti...

CVSS:

9.8

Affected:

up to 5.4.6

Fixed in:

5.4.7

Disclosed:

Sep 30, 2024

CVE-2024-9265 on NVD →