{"id":"CVE-2026-110530","kind":"vulnerability","aliases":["CVE-2026-110530"],"related":[],"title":"FeedWordPress: syndicated feed content stores scripts that run in visitors' browsers","description":"The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The FeedWordPress plugin strips WordPress's HTML safety filters from imported RSS and Atom items and removes only the target attribute, so script embedded in a feed is saved to the site. When a user opens the injected page, the script runs in their browser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"feedwordpress","fixed":["2026.1016"],"affected":"<= 2026.0517","ecosystem":"wordpress"}],"ecosystems":[],"tags":["feedwordpress","package","self-hosted","wordpress","xss"],"not_affected_if":["fixed-2026.1016","no-external-feeds","no-feedwordpress"],"how_to_check":"- WordPress admin > Plugins: is FeedWordPress installed, and is its version 2026.0517 or earlier?\n- Check Syndication > Feeds: does the site subscribe to any external feed you do not control?\n- Search imported posts for <script or on...= attributes (for example in the posts table).","fix":"Update the FeedWordPress plugin to 2026.1016 or later (latest 2026.1030). The fix filters content only at syndication time, so posts already imported stay unfiltered until you delete and resyndicate them, or the source feed publishes an updated version of the item.","status":"open","published_at":"2026-10-31T09:16:32+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","triaged_at":"2026-10-31T09:35:44+00:00","updated_at":"2026-10-31T09:38:17+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-31T09:35:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FeedWordPress: syndicated feed content stores scripts that run in visitors' browsers","impact":"medium","summary":"The FeedWordPress plugin strips WordPress's HTML safety filters from imported RSS and Atom items and removes only the target attribute, so script embedded in a feed is saved to the site. When a user opens the injected page, the script runs in their browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","feedwordpress","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm the fixed version of FeedWordPress after 2026.0517 at the NVD entry and the plugin's changelog.","how_to_check":"- Check whether the `feedwordpress` plugin is installed and its version is `2026.0517` or earlier\n- Check whether the site subscribes to any external feeds through FeedWordPress\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["no-feedwordpress","no-external-feeds"],"who_is_affected":"Sites running FeedWordPress up to and including 2026.0517 that subscribe to external RSS or Atom feeds. An attacker needs control of a feed the site already syndicates, not a site account. Sites without FeedWordPress or without subscribed feeds are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4304,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version of FeedWordPress after 2026.0517 at the NVD entry and the plugin's changelog.","search":"'-110530':14A,17A '-2026':13A,16A '2026.0517':90C 'a-z':116C 'access':188C 'alreadi':172C 'arbitrari':177C 'atom':39B 'attack':162C 'attribut':46B,107C,122C 'browser':11A,70B 'comment':124C 'content':4A,95C,101C,144C 'control':164C 'cross':81C 'cross-sit':80C 'cve':12A,15A 'deliber':130C 'embed':49B 'event':120C 'event-handl':119C 'execut':184C 'extern':166C 'feed':3A,52B,94C,150C,167C 'feedwordpress':1A,18A,19B,27B,72C 'filter':34B,135C,139C,142C 'function':102C 'handler':121C 'host':23B 'html':32B 'import':36B,149C 'includ':89C 'inject':63B,176C,190C 'insert':128C,154C 'item':40B,151C 'kses':136C,141C 'line':109C 'make':157C 'open':61B 'packag':20B 'page':64B,181C,191C 'persist':148C 'plugin':28B,73C,97C 'possibl':159C 'post':129C,140C,155C 'pre':146C 'remov':42B,131C 'rss':37B 'rss/atom':93C 'run':8A,67B 'safeti':33B 'sanit':100C 'save':54B,145C 'script':6A,48B,66B,83C,179C 'self':22B 'self-host':21B 'site':57B,82C,170C 'store':5A,79C 'strip':29B,104C,112C 'style':113C 'subscrib':173C 'syndic':2A,92C 'syndicatedpost':99C,127C 'target':45B,106C 'unauthent':161C 'user':60B,187C 'version':85C 'via':91C,152C 'visitor':10A 'vulner':77C 'web':178C 'whenev':185C 'wordpress':24B,30B,75C,132C 'would':111C 'wp':134C,138C,153C 'xss':25B 'z':118C","nicknames":[],"mitigations":[],"who_affected":"Sites running FeedWordPress up to and including 2026.0517 that subscribe to external RSS or Atom feeds. An attacker needs control of a feed the site already syndicates, not a site account. Sites without FeedWordPress or without subscribed feeds are not affected.","tier":"B","verified":{"fix":{"at":"2026-10-31T09:38:17Z","by":"analyst","doc":"https://wordpress.org/plugins/feedwordpress/#developers","run_id":1237},"how_to_check":{"at":"2026-10-31T09:38:17Z","by":"analyst","doc":"https://wordpress.org/plugins/feedwordpress/#developers","run_id":1237},"who_affected":{"at":"2026-10-31T09:38:17Z","by":"analyst","doc":"https://wordpress.org/plugins/feedwordpress/#developers","run_id":1237}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T09:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110530","severity":null,"published_at":"2026-10-31T09:16:32+00:00","modified_at":"2026-10-31T09:16:32+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","fetched_at":"2026-10-31T09:34:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110530:1237","url":null,"severity":null,"published_at":"2026-10-31T09:38:17+00:00","modified_at":"2026-10-31T09:38:17+00:00","first_seen_at":"2026-10-31T09:38:17+00:00","fetched_at":"2026-10-31T09:38:17+00:00","note":"Maintainer changelog on wordpress.org says 2026.1016 fixes it (KSES filtering of syndicated content); latest is 2026.1030. Existing stored posts are not cleaned: erase and resyndicate. No exploitation or PoC found."}],"documents":[{"id":31104,"url":"https://wordpress.org/plugins/feedwordpress/#developers","title":"FeedWordPress changelog (WordPress.org): 2026.1016 addresses CVE-2026-110530","kind":"release","source":"analyst","publisher":null,"text":"2026.1016: SECURITY HARDENING: syndicated content now filtered through WordPress KSES before storage. Thanks to Adrien Brunner and Wordfence for the report. Addresses CVE-2026-110530. Content is filtered at syndication time; existing posts are not affected unless erased and resyndicated, or updated versions appear on the source feed. Requires WordPress 6.2+. Latest: 2026.1030.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":31104,"url":"https://wordpress.org/plugins/feedwordpress/#developers","title":"FeedWordPress changelog (WordPress.org): 2026.1016 addresses CVE-2026-110530","kind":"release","source":"analyst","publisher":null,"text":"2026.1016: SECURITY HARDENING: syndicated content now filtered through WordPress KSES before storage. Thanks to Adrien Brunner and Wordfence for the report. Addresses CVE-2026-110530. Content is filtered at syndication time; existing posts are not affected unless erased and resyndicated, or updated versions appear on the source feed. Requires WordPress 6.2+. Latest: 2026.1030.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}