Actions
Bug #16770
closed
Potential XSS in RSS Widget feed content post titles
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The RSS widget library does not encode post titles before display as it does with other content. As a consequence, if a feed configured in the RSS widget supplies content with a malicious payload in a post title, it could be delivered to the user's browser and executed.
A sample feed is attached.
Files
Updated by
Actions