Stored Cross-Site Scripting Vulnerability in FeedWordPress Plugin by WordPress

CVE-2026-110530

What is CVE-2026-110530?

The FeedWordPress plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability in versions up to and including 2026.0517. This issue arises through the processing of external RSS/Atom feed content. The vulnerability is due to inadequate sanitization of user-supplied data, allowing unauthenticated attackers controlling an external feed to inject malicious scripts into web pages. The plugin's SyndicatedPost::sanitize_content() function fails to effectively remove potentially harmful attributes, while also bypassing essential filtering mechanisms, consequently enabling attackers to execute arbitrary scripts on the affected sites when users visit the compromised pages.

References