Live › vulnerability › CVE-2026-110530
The FeedWordPress plugin strips WordPress's HTML safety filters from imported RSS and Atom items and removes only the target attribute, so script embedded in a feed is saved to the site. When a user opens the injected page, the script runs in their browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 09:34 UTC. All times on this page are UTC.
Sites running FeedWordPress up to and including 2026.0517 that subscribe to external RSS or Atom feeds. An attacker needs control of a feed the site already syndicates, not a site account. Sites without FeedWordPress or without subscribed feeds are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| feedwordpress | wordpress | <= 2026.0517 | 2026.1016 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-110530")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.