XXE attacks are caused by configuration settings of the XML parser. Generally the default config is to allow external entities, and the calling code needs to override that config because the documents come from untrusted sources.

RSS 1.0 and 2.0 are completely incompatible. There is a whole boring politics story there..