Executive brief
RexTheme Product Feed Manager, a WordPress plugin used to generate product feeds for marketing channels like Google Shopping and WooCommerce, is vulnerable to unauthenticated Cross-Site Scripting (XSS). An attacker can inject malicious scripts into the website, which could lead to unauthorized actions being performed in the context of a logged-in administrator's session. This may result in site defacement, redirection of visitors to malicious websites, or the theft of sensitive session information.
Technical details
The RexTheme Product Feed Manager plugin for WordPress (versions <= 7.6.1) contains an unauthenticated Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation (CWE-79). A remote, unauthenticated attacker can exploit this by sending a specially crafted request that includes malicious JavaScript. Because the vulnerability is unauthenticated and has a 'Scope: Changed' (S:C) impact, successful exploitation requires a victim (typically an administrator) to interact with a malicious link or page. This allows the attacker to execute arbitrary script in the victim's browser session, potentially leading to privilege escalation or full site compromise. The issue is resolved in version 7.6.2.
Affected products
- RexTheme Product Feed Manager <= 7.6.1
Timeline
- 2026-04-17: other: Vulnerability reported by hhhai
- 2026-07-24: advisory: Patchstack advisory published
- 2026-07-27: disclosed: NVD publication date
- 2026-07-27: patched: Version 7.6.2 released to address the vulnerability