{"id":"CVE-2026-110707","kind":"vulnerability","aliases":["CVE-2026-110707"],"related":[],"title":"RSS Aggregator by Feedzy WordPress plugin: stored XSS via imported feed descriptions","description":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.","summary":"The RSS Aggregator by Feedzy WordPress plugin fails to sanitize the media:group/media:description element of imported feeds, so script can be stored in posts. When an administrator runs an import from an attacker-controlled feed, the injected script executes in the browser of anyone who opens the affected page.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["feedzy","package","wordpress","wordpress-plugins"],"not_affected_if":["no-feed-imports","plugin-newer-than-5.2.12","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get feedzy-rss-feeds --field=version` (plugin slug assumed; unknown if the sources give it)\n- Look for Feed-to-Post import jobs that pull from external feed URLs you do not control","fix":"- Move the RSS Aggregator by Feedzy plugin to a version later than `5.2.12`; the sources do not name the fixed version","status":"open","published_at":"2026-10-29T10:17:02+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","triaged_at":"2026-10-29T10:25:34+00:00","updated_at":"2026-10-29T10:25:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T10:25:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move the RSS Aggregator by Feedzy plugin to a version later than `5.2.12`; the sources do not name the fixed version","reach":"internet","title":"RSS Aggregator by Feedzy WordPress plugin: stored XSS via imported feed descriptions","impact":"medium","summary":"The RSS Aggregator by Feedzy WordPress plugin fails to sanitize the media:group/media:description element of imported feeds, so script can be stored in posts. When an administrator runs an import from an attacker-controlled feed, the injected script executes in the browser of anyone who opens the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","feedzy"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed version and the plugin slug from the vendor or NVD entry; the sources give only 'up to and including 5.2.12'.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get feedzy-rss-feeds --field=version` (plugin slug assumed; unknown if the sources give it)\n- Look for Feed-to-Post import jobs that pull from external feed URLs you do not control","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-feed-imports","plugin-newer-than-5.2.12"],"who_is_affected":"Sites running the RSS Aggregator by Feedzy plugin at version 5.2.12 or earlier that import content from external feeds. Exposure needs an administrator to set up or run an import from an attacker-controlled feed URL, which is the plugin's normal flow, so sites that only use manually written content or do not run feed imports are less exposed. unknown whether the sources list other conditions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000783,"input_tokens":4298,"output_tokens":707,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110707':15A,18A '-2026':14A,17A '5.2.12':120C 'access':149C 'action':181C 'administr':52B,156C 'affect':74B 'aggreg':2A,27B,78C,89C 'anyon':70B 'arbitrari':138C 'attack':59B,135C,169C 'attacker-control':58B,168C 'autoblog':84C 'browser':68B 'configur':158C,191C 'control':60B,170C 'cross':98C 'cross-sit':97C 'cve':13A,16A 'descript':12A,38B,105C 'due':121C 'element':39B,107C 'escap':128C 'execut':65B,145C 'exploit':153C 'fail':32B 'feed':11A,42B,61B,81C,88C,111C,161C,171C 'feed-to-post':160C 'feedzi':4A,19B,29B,80C 'flow':192C 'group/media':37B,104C 'import':10A,41B,55B,110C,164C,176C 'includ':119C 'inject':63B,137C,151C 'input':124C 'insuffici':123C 'make':130C 'media':36B,103C 'news':85C 'open':72B 'output':127C 'packag':20B 'page':75B,142C,152C 'paramet':112C 'plugin':6A,24B,31B,90C,188C 'point':165C 'possibl':132C 'post':49B,83C,163C 'requir':154C 'rss':1A,26B,77C 'run':53B,179C 'sanit':34B,125C 'script':44B,64B,100C,140C 'setup':183C 'site':99C 'standard':190C 'store':7A,47B,96C 'trigger':174C 'unauthent':134C 'url':172C 'user':148C 'version':115C 'via':9A,101C,177C 'video':87C 'vulner':94C 'web':139C 'whenev':146C 'wizard':184C 'wordpress':5A,21B,23B,30B,92C 'wordpress-plugin':22B 'xml':106C 'xss':8A 'youtub':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the RSS Aggregator by Feedzy plugin at version 5.2.12 or earlier that import content from external feeds. Exposure needs an administrator to set up or run an import from an attacker-controlled feed URL, which is the plugin's normal flow, so sites that only use manually written content or do not run feed imports are less exposed. unknown whether the sources list other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T10:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110707","severity":null,"published_at":"2026-10-29T10:17:02+00:00","modified_at":"2026-10-29T10:17:02+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","fetched_at":"2026-10-29T10:24:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}