{"id":"CVE-2026-120035","kind":"vulnerability","aliases":["CVE-2026-120035"],"related":[],"title":"Feedzy RSS Aggregator WordPress plugin: feed titles enable stored cross-site scripting","description":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.","summary":"The Feedzy RSS Aggregator WordPress plugin stores the title of each imported feed item without sanitizing it, so the title can carry script. When a visitor opens a page holding that imported post, the script runs in their browser.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["feedzy","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["feed-url-trusted","no-feed-to-post-import","plugin-not-installed"],"how_to_check":"- Check the installed version of the Feedzy RSS Aggregator plugin in the WordPress admin plugin list and compare it with `5.2.13`.\n- Review whether any Feed-to-Post import is configured to pull from feed URLs you do not control.","fix":"- Move the Feedzy RSS Aggregator plugin to a version later than `5.2.13`, as the sources state the flaw covers all versions up to and including `5.2.13`. The exact fixed version is unknown.","status":"open","published_at":"2026-11-06T12:17:20+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:52+00:00","updated_at":"2026-11-06T12:42:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T12:42:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Feedzy RSS Aggregator plugin to a version later than `5.2.13`, as the sources state the flaw covers all versions up to and including `5.2.13`. The exact fixed version is unknown.","reach":"internet","title":"Feedzy RSS Aggregator WordPress plugin: feed titles enable stored cross-site scripting","impact":"medium","summary":"The Feedzy RSS Aggregator WordPress plugin stores the title of each imported feed item without sanitizing it, so the title can carry script. When a visitor opens a page holding that imported post, the script runs in their browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","feedzy","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Injected script runs in visitors' browsers on the affected site","analyst_note":"","how_to_check":"- Check the installed version of the Feedzy RSS Aggregator plugin in the WordPress admin plugin list and compare it with `5.2.13`.\n- Review whether any Feed-to-Post import is configured to pull from feed URLs you do not control.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-feed-to-post-import","feed-url-trusted"],"who_is_affected":"Sites running the Feedzy RSS Aggregator WordPress plugin version 5.2.13 or older that have an administrator-configured Feed-to-Post import pulling from an external feed URL. Sites without the plugin, or without such imports, are not exposed through this path. The attacker needs no account, but the feed must be one an attacker can control and an administrator must have set it up.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4386,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120035':16A,19A '-2026':15A,18A '5.2.13':108C 'access':137C 'administr':144C 'aggreg':3A,32B,70C,81C 'arbitrari':126C 'attack':123C,159C,166C 'attacker-control':158C 'autoblog':76C 'browser':67B 'carri':50B 'configur':148C 'control':160C 'cross':11A,90C 'cross-sit':10A,89C 'cve':14A,17A 'due':109C 'enabl':8A 'escap':116C 'execut':133C 'feed':6A,41B,73C,80C,99C,151C,161C 'feed-to-post':150C 'feedzi':1A,20B,30B,72C 'hold':58B 'host':24B 'import':40B,60B,154C 'includ':107C 'inject':125C,139C 'input':112C 'insuffici':111C 'interact':175C 'item':42B,95C 'make':118C 'news':77C 'open':55B 'output':115C 'packag':21B 'page':57B,130C,140C 'paramet':100C 'pars':97C 'payload':169C 'plugin':5A,28B,34B,82C 'point':155C 'possibl':120C 'post':61B,75C,153C 'previous':147C 'requir':142C 'rotat':168C 'rss':2A,31B,69C 'run':64B 'sanit':44B,113C 'script':13A,51B,63B,92C,128C 'self':23B 'self-host':22B 'site':12A,91C,178C 'store':9A,35B,88C 'titl':7A,37B,48B,96C 'unauthent':122C 'url':162C 'user':136C 'version':103C 'via':93C 'video':79C 'visitor':54B 'vulner':86C 'web':127C 'whenev':134C 'without':43B,172C 'wordpress':4A,25B,27B,33B,84C 'wordpress-plugin':26B 'youtub':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Feedzy RSS Aggregator WordPress plugin version 5.2.13 or older that have an administrator-configured Feed-to-Post import pulling from an external feed URL. Sites without the plugin, or without such imports, are not exposed through this path. The attacker needs no account, but the feed must be one an attacker can control and an administrator must have set it up.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["feedzy","medium","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-120035':16A,19A '-2026':15A,18A 'aggreg':3A 'cross':11A 'cross-sit':10A 'cve':14A,17A 'enabl':8A 'feed':6A 'feedzi':1A 'plugin':5A 'rss':2A 'script':13A 'site':12A 'store':9A 'titl':7A 'wordpress':4A","search_b":"'aggreg':32B 'browser':67B 'carri':50B 'feed':41B 'feedzi':20B,30B 'hold':58B 'host':24B 'import':40B,60B 'item':42B 'open':55B 'packag':21B 'page':57B 'plugin':28B,34B 'post':61B 'rss':31B 'run':64B 'sanit':44B 'script':51B,63B 'self':23B 'self-host':22B 'store':35B 'titl':37B,48B 'visitor':54B 'without':43B 'wordpress':25B,27B,33B 'wordpress-plugin':26B","search_c":"'5.2.13':108C 'access':137C 'administr':144C 'aggreg':70C,81C 'arbitrari':126C 'attack':123C,159C,166C 'attacker-control':158C 'autoblog':76C 'configur':148C 'control':160C 'cross':90C 'cross-sit':89C 'due':109C 'escap':116C 'execut':133C 'feed':73C,80C,99C,151C,161C 'feed-to-post':150C 'feedzi':72C 'import':154C 'includ':107C 'inject':125C,139C 'input':112C 'insuffici':111C 'interact':175C 'item':95C 'make':118C 'news':77C 'output':115C 'page':130C,140C 'paramet':100C 'pars':97C 'payload':169C 'plugin':82C 'point':155C 'possibl':120C 'post':75C,153C 'previous':147C 'requir':142C 'rotat':168C 'rss':69C 'sanit':113C 'script':92C,128C 'site':91C,178C 'store':88C 'titl':96C 'unauthent':122C 'url':162C 'user':136C 'version':103C 'via':93C 'video':79C 'vulner':86C 'web':127C 'whenev':134C 'without':172C 'wordpress':84C 'youtub':78C","first_public_at":"2026-11-06T12:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120035","severity":null,"published_at":"2026-11-06T12:17:20+00:00","modified_at":"2026-11-06T12:17:20+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}