Stored Cross-Site Scripting Vulnerability in Feedzy RSS Aggregator Plugin for WordPress
CVE-2026-110707

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
Rss Aggregator By Feedzy – Feed To Post, Autoblogging, News & Youtube Video Feeds Aggregator
Vendor
CVE Published:
29 October 2026

What is CVE-2026-110707?

The Feedzy RSS Aggregator plugin allows unauthenticated attackers to exploit a stored cross-site scripting vulnerability through the 'media:group/media:description' parameter in the imported feed. This issue arises from inadequate input sanitization and output escaping processes. Attackers can leverage this weakness by setting up a malicious feed URL and triggering import actions via standard plugin configurations. Once executed, arbitrary scripts can run whenever users access affected pages, posing a significant security risk.

Affected Version(s)

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 0 <= 5.2.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/feedzy-rss-fee...
https://plugins.trac.wordpress.org/browser/feedzy-rss-fee...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hamachi_jp
.