PT-2026-21001 · Unknown · Rachelos Werss We-Mp-Rss

Din4 · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-2825

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions rachelos WeRSS we-mp-rss versions up to 1.4.8

Description A flaw exists in the fix html function within the tools/fix.py file of the Article Module component. This issue allows for cross site scripting, and can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Update rachelos WeRSS we-mp-rss to a version later than 1.4.8.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-2825

Affected Products

Rachelos Werss We-Mp-Rss

References · 7

• 🔥 https://notion.so/WeRSS-Stored-Cross-Site-Scripting-XSS-in-Article-module-300ea92a3c4180be87dffca6b47d17f7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2825 · Security Note
• https://vuldb.com/?submit.753879 · Note
• https://t.me/CVEtracker/45257 · Telegram Post
• https://vuldb.com/?ctiid.346950 · Note
• https://vuldb.com/?id.346950 · Note
• https://t.me/cveNotify/152563 · Telegram Post