Stored Cross-Site Scripting in Feedzy RSS Aggregator Plugin for WordPress
CVE-2026-120035

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Rss Aggregator By Feedzy – Feed To Post, Autoblogging, News & Youtube Video Feeds Aggregator
Vendor
CVE Published:
6 November 2026

What is CVE-2026-120035?

The Feedzy RSS Aggregator plugin for WordPress contains a vulnerability allowing for Stored Cross-Site Scripting (XSS) due to inadequate input sanitization on the 'item_title' parameter. This security flaw permits unauthenticated attackers to inject malicious scripts through manipulated feed URLs. If an administrator has previously set up a Feed-to-Post import pointing at an attacker-controlled feed, they inadvertently create opportunities for recurring script execution whenever users access the compromised pages.

Affected Version(s)

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 0 <= 5.2.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/feedzy-rss-fee...
https://plugins.trac.wordpress.org/browser/feedzy-rss-fee...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

churchill11
.