Stored Cross-Site Scripting in Feedzy RSS Aggregator Plugin for WordPress

CVE-2026-104735

What is CVE-2026-104735?

The Feedzy RSS Aggregator plugin for WordPress is susceptible to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping in versions up to 5.2.10. Authenticated users with contributor-level access or higher can exploit this vulnerability by injecting arbitrary scripts into web pages. The malicious content is drawn from the attacker-controlled RSS feed title and executed when a user accesses the affected page, as the benign block reference stored at save time does not neutralize the potentially harmful HTML. This poses significant security risks, allowing attackers to manipulate web content and potentially breach user trust.

References