Stored Cross-Site Scripting in RSS Aggregator by Feedzy for WordPress
CVE-2026-109207

7.2HIGH

Key Information:

Vendor

WordPress
Status
Rss Aggregator By Feedzy – Feed To Post, Autoblogging, News & Youtube Video Feeds Aggregator
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109207?

The RSS Aggregator by Feedzy plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'media:thumbnail@url' parameter. This issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. When users access these pages, the scripts execute, posing a risk to site security. To exploit this vulnerability, an attacker must manipulate an external RSS feed already imported into the target site without requiring specific WordPress credentials or additional plugin settings.

Affected Version(s)

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 0 <= 5.2.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/feedzy-rss-fee...
https://plugins.trac.wordpress.org/browser/feedzy-rss-fee...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrien Brunner
.