---
id: "CVE-2026-110530"
kind: "vulnerability"
aliases: ["CVE-2026-110530"]
title: "FeedWordPress: syndicated feed content stores scripts that run in visitors' browsers"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "feedwordpress", "fixed": ["2026.1016"], "affected": "<= 2026.0517", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["feedwordpress", "package", "self-hosted", "wordpress", "xss"]
not_affected_if: ["fixed-2026.1016", "no-external-feeds", "no-feedwordpress"]
published_at: "2026-10-31T09:16:32+00:00"
first_seen_at: "2026-10-31T09:34:41+00:00"
updated_at: "2026-10-31T09:38:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110530", "first_seen_at": "2026-10-31T09:34:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T09:38:17+00:00"}]
---

# FeedWordPress: syndicated feed content stores scripts that run in visitors' browsers

The FeedWordPress plugin strips WordPress's HTML safety filters from imported RSS and Atom items and removes only the target attribute, so script embedded in a feed is saved to the site. When a user opens the injected page, the script runs in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:feedwordpress affected <= 2026.0517 fixed 2026.1016

## How to check

- WordPress admin > Plugins: is FeedWordPress installed, and is its version 2026.0517 or earlier?
- Check Syndication > Feeds: does the site subscribe to any external feed you do not control?
- Search imported posts for <script or on...= attributes (for example in the posts table).

## Fix

Update the FeedWordPress plugin to 2026.1016 or later (latest 2026.1030). The fix filters content only at syndication time, so posts already imported stay unfiltered until you delete and resyndicate them, or the source feed publishes an updated version of the item.

## Timeline

- 2026-10-31T09:34:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110530
- 2026-10-31T09:38:17+00:00 analyst — Maintainer changelog on wordpress.org says 2026.1016 fixes it (KSES filtering of syndicated content); latest is 2026.1030. Existing stored posts are not cleaned: erase and resyndicate. No exploitation or PoC found.

## Documents

- [advisory] FeedWordPress changelog (WordPress.org): 2026.1016 addresses CVE-2026-110530 https://wordpress.org/plugins/feedwordpress/#developers
- [fix] FeedWordPress changelog (WordPress.org): 2026.1016 addresses CVE-2026-110530 https://wordpress.org/plugins/feedwordpress/#developers

## From the sources

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_