Threat Entry Updated 2025-07-25

CVE-2025-6382 - Taeggie Feed Plugin

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's taeggie-feed shortcode in all versions up to, and including, 0.1.10. The plugin’s render() method takes the user-supplied name attribute and injects it directly into a tag - both in the id attribute and inside jQuery.getScript() - without proper escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Taeggie Feed

CVE-2025-6382

MEDIUM CVSS 6.4 2025-07-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-12-18

CVE-2024-11748 - Taeggie Feed Plugin

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Taeggie Feed

CVE-2024-11748

MEDIUM CVSS 6.4 2024-12-18

Risk Score

Open Full Technical Breakdown