CVE-2023-6801 in RSS Aggregator Plugin
Summary
by MITRE • 01/06/2024
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6801 affects the RSS Aggregator by Feedzy plugin for WordPress, specifically targeting versions up to and including 4.3.2. This represents a critical security flaw that exploits the plugin's insufficient input sanitization and output escaping mechanisms within its administrative settings interface. The vulnerability is classified as a stored cross-site scripting vulnerability, meaning that malicious scripts can be permanently stored on the server and executed whenever affected pages are accessed by unsuspecting users. The attack vector requires authentication with author-level permissions or higher, making it particularly concerning for WordPress environments where multiple users with varying permission levels exist.
The technical implementation of this vulnerability stems from the plugin's failure to properly sanitize user inputs submitted through the administrative configuration panels. When administrators or authorized users modify plugin settings, the input data is not adequately filtered or escaped before being stored in the database and subsequently rendered in web pages. This allows attackers to inject malicious JavaScript code that persists in the system and executes in the context of other users' browsers. The vulnerability is particularly dangerous because it operates at the administrative level, where attackers can manipulate plugin configurations to affect all users who access pages containing the stored malicious content.
From an operational impact perspective, this vulnerability creates significant risks for WordPress installations using the Feedzy plugin. Attackers with author-level access can inject scripts that may steal session cookies, redirect users to malicious websites, or perform actions on behalf of authenticated users. The stored nature of the XSS vulnerability means that the malicious code remains active until manually removed by administrators, potentially affecting multiple users over extended periods. This vulnerability also aligns with CWE-79 which specifically addresses cross-site scripting flaws, and can be mapped to ATT&CK technique T1566.001 for credential access through social engineering and T1059.001 for execution through script-based attacks, making it a multi-faceted threat that can escalate to broader system compromise.
Organizations affected by this vulnerability should immediately update to the latest version of the Feedzy plugin where the XSS vulnerability has been addressed through proper input sanitization and output escaping mechanisms. Administrators should also implement additional security measures such as monitoring user permissions, restricting access to plugin settings for non-essential personnel, and conducting regular security audits of installed plugins. The mitigation strategy should include immediate patching of the vulnerable plugin, followed by thorough scanning of affected systems for any signs of malicious code injection. Security teams should also consider implementing web application firewalls and content security policies to provide additional layers of protection against similar vulnerabilities in the future, ensuring that all user inputs are properly validated and escaped before being processed or displayed in web interfaces.