RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Titles
- ID
- WPSEC-2026-2622
- Plugin
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (feedzy-rss-feeds)
- Affected
- from 3.4.0 before 5.2.14
- Remediation
- Update to 5.2.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- RSS Aggregator by Feedzy on WPSec AttackSurface
- Fix released
- Published
Description
The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed item titles in all versions up to, and including, 5.2.13, due to insufficient input sanitization of feed item titles, which are HTML-entity-decoded and then used unchanged as attachment titles when featured images are sideloaded during feed imports. This makes it possible for unauthenticated attackers who control the content of a feed being imported by the site to inject arbitrary web scripts into attachment titles that will execute whenever a user accesses a page where those titles are rendered. Exploitation requires the site to import a feed whose content the attacker controls with featured image import enabled. The script markup is kept only when the import runs as a user with the unfiltered_html capability, such as an administrator running the import manually.
References
- https://wpsec.com/vuln/WPSEC-2026-2622/
- https://plugins.svn.wordpress.org/feedzy-rss-feeds/tags/5.2.14/
- https://wordpress.org/plugins/feedzy-rss-feeds/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS