---
id: "CVE-2026-120035"
page: "https://infrastack.ai/live/CVE-2026-120035"
kind: "vulnerability"
aliases: ["CVE-2026-120035"]
title: "Feedzy RSS Aggregator WordPress plugin: feed titles enable stored cross-site scripting"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["feedzy", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["feed-url-trusted", "no-feed-to-post-import", "plugin-not-installed"]
published_at: "2026-11-06T12:17:20+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:42:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120035", "first_seen_at": "2026-11-06T12:41:48+00:00"}]
exploit_sources: []
---

# Feedzy RSS Aggregator WordPress plugin: feed titles enable stored cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-120035 (this .md is for agents)

The Feedzy RSS Aggregator WordPress plugin stores the title of each imported feed item without sanitizing it, so the title can carry script. When a visitor opens a page holding that imported post, the script runs in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Feedzy RSS Aggregator plugin in the WordPress admin plugin list and compare it with `5.2.13`.
- Review whether any Feed-to-Post import is configured to pull from feed URLs you do not control.

## Fix

- Move the Feedzy RSS Aggregator plugin to a version later than `5.2.13`, as the sources state the flaw covers all versions up to and including `5.2.13`. The exact fixed version is unknown.

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120035

## From the sources

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_