CVE-2026-2825: XSS in WeRSS we-mp-rss 1.4.8

The XSS vulnerability in WeRSS we-mp-rss allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a victim's browser when they visit a vulnerable page. Attackers could leverage this to steal session cookies, redirect users to malicious websites, deface the website, or execute other malicious actions. The impact is amplified if the website is used for sensitive data processing or handles user authentication, as attackers could potentially gain unauthorized access to user accounts and data. The remote accessibility of the vulnerability increases the attack surface and potential for widespread exploitation.

1. Reserved2026-02-19
2. Published2026-02-20
3. Modified2026-02-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-2825 is to upgrade WeRSS we-mp-rss to a version that includes the fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on user-supplied data within the fix_html function to sanitize potentially malicious input. Web application firewalls (WAFs) configured with rules to detect and block XSS attacks can provide an additional layer of protection. Regularly review and update security policies and procedures to ensure they address XSS vulnerabilities.