Live › vulnerability › CVE-2026-110707
The RSS Aggregator by Feedzy WordPress plugin fails to sanitize the media:group/media:description element of imported feeds, so script can be stored in posts. When an administrator runs an import from an attacker-controlled feed, the injected script executes in the browser of anyone who opens the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:24 UTC. All times on this page are UTC.
Sites running the RSS Aggregator by Feedzy plugin at version 5.2.12 or earlier that import content from external feeds. Exposure needs an administrator to set up or run an import from an attacker-controlled feed URL, which is the plugin's normal flow, so sites that only use manually written content or do not run feed imports are less exposed. unknown whether the sources list other conditions.
No product ranges from the sources yet.
wp plugin get feedzy-rss-feeds --field=version (plugin slug assumed; unknown if the sources give it)5.2.12; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
This page as .md · .json · in your agent: get_signal("CVE-2026-110707")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.