WP-Safety

Multi RSS Security & Risk Analysis

wordpress.org/plugins/multi-rss

Multi RSS combines and displays multiple RSS feeds as a single feed. The plugin depends on the SimplePie RSS Feed Parser for PHP.

10 active installs v1.0 PHP + WP 2.5+ Updated Jul 29, 2009
feedsrsssimplepie
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Plugin page Download
Safety Verdict

Is Multi RSS Safe to Use in 2026?

Generally Safe

Score 85/100

Multi RSS has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 16yr ago
Risk Assessment

The "multi-rss" v1.0 plugin exhibits a mixed security posture. While it has a small attack surface with no AJAX handlers or REST API routes found, and a seemingly clean vulnerability history with no known CVEs, there are significant concerns within its code. The most alarming finding is the complete lack of prepared statements for all five SQL queries, making it highly susceptible to SQL injection vulnerabilities. Additionally, only 10% of output is properly escaped, posing a risk of cross-site scripting (XSS) vulnerabilities. The taint analysis reveals two critical flows with unsanitized paths, indicating potential for attackers to manipulate data or execute unintended actions.

Key Concerns

  • Raw SQL queries without prepared statements
  • Low output escaping percentage
  • Critical taint flows with unsanitized paths
  • No nonce checks
  • No capability checks
Vulnerabilities
None known

Multi RSS Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 17, 2026

Multi RSS Code Analysis

Dangerous Functions
0
Raw SQL Queries
5
0 prepared
Unescaped Output
9
1 escaped
Nonce Checks
0
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

0% prepared5 total queries

Output Escaping

10% escaped10 total outputs
Data Flows
2 unsanitized

Data Flow Analysis

2 flows2 with unsanitized paths
multi_rss_options (multiRSS.php:215)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Multi RSS Attack Surface

Entry Points1
Unprotected0

Shortcodes 1

[multiRSSDisplay] multiRSS.php:46
WordPress Hooks 1
actionadmin_menumultiRSS.php:34
Maintenance & Trust

Multi RSS Maintenance & Trust

Maintenance Signals

WordPress version tested2.7.1
Last updatedJul 29, 2009
PHP min version
Downloads4K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Alternatives

Multi RSS Alternatives

Disable Feeds

Disable Feeds

disable-feeds

A
85

Disables all RSS/Atom/RDF feeds on your WordPress site.

30K No CVEs
GN Publisher: Google News Compatible RSS Feeds

GN Publisher: Google News Compatible RSS Feeds

gn-publisher

A
100

GN Publisher makes RSS feeds that comply with the Google News RSS Feed Technical Requirements for including your site in the Google News.

20K 1 CVE
Disable Feeds WP

Disable Feeds WP

disable-feeds-wp

A
100

Disables all RSS/Atom/RDF feeds on your WordPress site.

10K No CVEs
RSS Includes Pages

RSS Includes Pages

rss-includes-pages

A
100

Modifies RSS feeds so that they include pages and not just posts.

10K 1 CVE
RSS Redirect & Feedburner Alternative

RSS Redirect & Feedburner Alternative

feedburner-alternative-and-rss-redirect

A
92

Free Feedburner Alternative and RSS Redirect plugin from follow.it.

1K No CVEs
Developer Profile

Multi RSS Developer Profile

robertcgreen

1 plugin · 10 total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Multi RSS

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/MultiRSS/style.css
Script Paths
/wp-content/plugins/MultiRSS/jquery.tablesorter.js
Version Parameters
MultiRSS/style.css?ver=MultiRSS/jquery.tablesorter.js?ver=

HTML / DOM Fingerprints

Shortcode Output
<a href="<span></span><img src="
FAQ

Frequently Asked Questions about Multi RSS