WordPress versions below 2.6.5 suffer from a stored cross site scripting vulnerability via the RSS Feed Generator.