RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Excerpt

ID

WPSEC-2026-1275

Plugin

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (feedzy-rss-feeds)

Affected

all versions before 5.2.13

Remediation

Update to 5.2.13 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21

Attack surface

RSS Aggregator by Feedzy on WPSec AttackSurface

Fix released

2026-10-19

Published

2026-10-21

Description

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported RSS feed item excerpts in all versions up to, and including, 5.2.12 due to insufficient input sanitization of the excerpt before it is saved to imported posts. This makes it possible for unauthenticated attackers who control or can poison a feed that a site administrator has configured for import to inject arbitrary web scripts that execute whenever a user views a page displaying the imported post excerpt. Exploitation requires that the site imports content from an attacker-influenced feed.

References

• https://wpsec.com/vuln/WPSEC-2026-1275/
• https://plugins.svn.wordpress.org/feedzy-rss-feeds/tags/5.2.13/
• https://wordpress.org/plugins/feedzy-rss-feeds/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS