RSS Aggregator by Feedzy <= 5.2.15 - Unauthenticated Content Injection via Lazy-Load Feed Cache Poisoning
- ID
- WPSEC-2026-3109
- Plugin
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (feedzy-rss-feeds)
- Affected
- from 3.3.18 before 5.2.16
- Remediation
- Update to 5.2.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- RSS Aggregator by Feedzy on WPSec AttackSurface
- Fix released
- Published
Description
The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Content Injection via the public lazy-load REST endpoint (feedzy/v1/lazy) in all versions up to, and including, 5.2.15, due to insufficient verification of the shortcode attributes in lazy-load requests. The endpoint verifies only a nonce tied to the feed URL, and logged-out visitors can obtain that nonce from any page that shows a lazy-loaded feed. It renders the feed with whatever other attributes the request sends and stores the result in a transient keyed only by the feed URL, max, offset and refresh values. Pages then serve that stored output in place of the configured feed. This makes it possible for unauthenticated attackers to change the feed content shown to every visitor of a page with a lazy-loaded Feedzy feed until the cache expires, for example by hiding or rearranging feed elements, adding attacker-chosen images or injecting markup that wp_kses_post allows.
References
- https://wpsec.com/vuln/WPSEC-2026-3109/
- https://plugins.svn.wordpress.org/feedzy-rss-feeds/tags/5.2.16/
- https://wordpress.org/plugins/feedzy-rss-feeds/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS