# RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Item Titles

- **ID:** WPSEC-2026-2622
- **Plugin:** RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (`feedzy-rss-feeds`), https://wordpress.org/plugins/feedzy-rss-feeds/
- **Affected versions:** from 3.4.0 before 5.2.14
- **Fixed in:** 5.2.14 (Update to 5.2.14 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/feedzy-rss-feeds
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2622/

## Description

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed item titles in all versions up to, and including, 5.2.13, due to insufficient input sanitization of feed item titles, which are HTML-entity-decoded and then used unchanged as attachment titles when featured images are sideloaded during feed imports. This makes it possible for unauthenticated attackers who control the content of a feed being imported by the site to inject arbitrary web scripts into attachment titles that will execute whenever a user accesses a page where those titles are rendered. Exploitation requires the site to import a feed whose content the attacker controls with featured image import enabled. The script markup is kept only when the import runs as a user with the unfiltered_html capability, such as an administrator running the import manually.

Also published later by wordfence as CVE-2026-120035.

## References

- https://wpsec.com/vuln/WPSEC-2026-2622/
- https://plugins.svn.wordpress.org/feedzy-rss-feeds/tags/5.2.14/
- https://wordpress.org/plugins/feedzy-rss-feeds/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2622/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.