RSS Includes Pages

RSS Includes Pages has one disclosed vulnerability in the WordSec catalog, all reported in 2017; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for RSS Includes Pages has a vendor fix available, so running the current release closes it.

All of these findings were reported by Neven Birusk. RSS Includes Pages is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all RSS Includes Pages vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1

RSS Includes Pages <= 3.6 - Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2017-04-14 00:00	RSS Includes Pages <= 3.6 - Cross-Site Scripting RSS Includes Pages < 3.7	`N/A`	6.1 Medium	Neven Birusk	Yes

Showing 1–1 of 1 reports

Latestv3.8

RSS Includes Pages

Author

Marios Alexandrou

3.9(17)

78/100

Last Updated

2026-08-20 (24d ago)

Active Installs

10,000+

Downloads

213,960

Requires WP

5.0+

Requires PHP

Tested up to

WP 7.1

Created

2008-09-04 (18y ago)

Modifies RSS feeds so that they include pages and not just posts. Deactivating the plugin restores RSS feeds to their default state. Including pages in your feed is particularly useful if you’re using WordPress as a CMS where pages represent a good portion of your content. The pro version (a lifetime license is less than $15) also allows you to: Specify that ONLY pages are included in the feeds i.e. no posts. Exclude/include posts and pages by ID. Add custom post types such as WooCommerce products or Avada portfolios.

View on WordPress.org