CVE-2026-120035 · Package
NO FIX YET · SEE WHAT TO DO
The Feedzy RSS Aggregator WordPress plugin stores the title of each imported feed item without sanitizing it, so the title can carry script. When a visitor opens a page holding that imported post, the script runs in their browser.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Feedzy RSS Aggregator WordPress plugin version 5.2.13 or older that have an administrator-configured Feed-to-Post import pulling from an external feed URL. Sites without the plugin, or without such imports, are not exposed through this path. The attacker needs no account, but the feed must be one an attacker can control and an administrator must have set it up.
Not affected if feed-url-trusted, no-feed-to-post-import, plugin-not-installed
Who cares feedzy, self-hosted, wordpress, wordpress-plugin
5.2.13.5.2.13, as the sources state the flaw covers all versions up to and including 5.2.13. The exact fixed version is unknown.The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.