WordPress security changelog
MEDIUM CVE-2026-104735 Deferred

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Cross-site scripting

A Contributor can save an apparently benign Feedzy block referencing an attacker-controlled RSS feed. A later malicious feed title reaches HTML rendering without adequate escaping, bypassing the earlier post-save WordPress filter. The export does not name the block attribute or renderer. Affected versions: <= 5.2.10.

CVE / CNA score 6.4 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Plugin slug
feedzy-rss-feeds
Affected
<= 5.2.10
Safe version
See mitigation notes
Published
Oct 10, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Oct 10, 2026 and is one of 10 known issues for this plugin.

What to do

Update, patch or deactivate.

This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Disable the affected feature or deactivate the component until a confirmed fix is available. Application-level remediation: Treat fetched feed content as untrusted on every refresh and escape titles at rendering time, rather than trusting save-time validation of the feed URL. Official author release notes: https://raw.githubusercontent.com/Codeinwp/feedzy-rss-feeds/master/CHANGELOG.md.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources