{"id":"CVE-2026-109207","kind":"vulnerability","aliases":["CVE-2026-109207"],"related":[],"title":"Feedzy RSS Aggregator WordPress plugin: stored XSS via media thumbnail URL","description":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.","summary":"The Feedzy RSS Aggregator WordPress plugin up to and including 5.2.11 does not sanitize the media:thumbnail URL taken from imported RSS feeds before outputting it. An unauthenticated attacker who controls a configured external feed can store JavaScript that runs in the browser of any visitor to the injected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-external-feeds","plugin-not-installed"],"how_to_check":"- Check the installed Feedzy RSS Aggregator version in the WordPress plugins screen or with `wp plugin get feedzy-rss-feeds --field=version`\n- Review which external feeds the site imports and whether any are from sources you do not control","fix":"- Update the Feedzy RSS Aggregator plugin to a version later than `5.2.11`\n- Remove or replace imported feeds from sources you do not trust until the update is applied","status":"open","published_at":"2026-10-16T04:18:26+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:29:57+00:00","updated_at":"2026-10-25T03:29:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Feedzy RSS Aggregator plugin to a version later than `5.2.11`\n- Remove or replace imported feeds from sources you do not trust until the update is applied","reach":"internet","title":"Feedzy RSS Aggregator WordPress plugin: stored XSS via media thumbnail URL","impact":"medium","summary":"The Feedzy RSS Aggregator WordPress plugin up to and including 5.2.11 does not sanitize the media:thumbnail URL taken from imported RSS feeds before outputting it. An unauthenticated attacker who controls a configured external feed can store JavaScript that runs in the browser of any visitor to the injected page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Script runs in visitors' browsers, may hijack admin sessions.","analyst_note":"Confirm the fixed version number on the NVD or Wordfence entry for CVE-2026-109207; sources provided do not name it.","how_to_check":"- Check the installed Feedzy RSS Aggregator version in the WordPress plugins screen or with `wp plugin get feedzy-rss-feeds --field=version`\n- Review which external feeds the site imports and whether any are from sources you do not control","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-external-feeds"],"who_is_affected":"Sites running the Feedzy RSS Aggregator plugin at version 5.2.11 or earlier that have at least one external RSS feed configured for import. Sites without that plugin or without imported feeds can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":3456,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109207':14A,17A '-2026':13A,16A '5.2.11':36B,114C 'access':143C 'account':168C 'aggreg':3A,29B,78C,89C 'alreadi':162C 'arbitrari':132C 'attack':54B,129C,150C 'autoblog':84C 'beyond':175C 'browser':68B 'condit':177C 'configur':58B,163C,172C 'control':56B,152C 'cross':98C 'cross-sit':97C 'cve':12A,15A 'due':115C 'escap':122C 'execut':139C 'extern':59B,154C 'feed':48B,60B,81C,88C,156C 'feedzi':1A,27B,80C 'host':21B 'import':46B,165C 'includ':35B,113C 'inject':74B,131C,145C 'input':118C 'insuffici':117C 'javascript':63B 'make':124C 'media':9A,41B,103C 'need':174C 'news':85C 'output':50B,121C 'packag':18B 'page':75B,136C,146C 'paramet':106C 'plugin':5A,25B,31B,90C,171C 'possibl':126C 'post':83C 'requir':148C 'rss':2A,28B,47B,77C,155C 'run':65B 'sanit':39B,119C 'script':100C,134C 'self':20B 'self-host':19B 'site':99C,160C 'special':170C 'store':6A,62B,96C 'taken':44B 'target':159C 'thumbnail':10A,42B,104C 'unauthent':53B,128C 'url':11A,43B,105C 'user':142C 'version':109C 'via':8A,101C 'video':87C 'visitor':71B 'vulner':94C 'web':133C 'whenev':140C 'wordpress':4A,22B,24B,30B,92C,167C 'wordpress-plugin':23B 'xss':7A 'youtub':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Feedzy RSS Aggregator plugin at version 5.2.11 or earlier that have at least one external RSS feed configured for import. Sites without that plugin or without imported feeds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109207","severity":null,"published_at":"2026-10-16T04:18:26+00:00","modified_at":"2026-10-16T15:17:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}