CVE-2026-104735 in RSS Aggregator by Feedzy Plugin
Summary
by MITRE • 10/10/2026
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator for WordPress affects all versions up through 5.2.10 and represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw stems from insufficient input sanitization and output escaping mechanisms within the plugin's architecture. Specifically, the vulnerability is triggered via the Feedzy Loop Block when handling feed URLs or RSS data. The core issue lies in how the application processes external feed content during rendering rather than at the point of initial storage. Because the post_content field stores only a benign block reference to an external feed URL, traditional save-time filtering mechanisms such as wp_kses are bypassed entirely. This architectural design choice allows malicious HTML and JavaScript payloads embedded within RSS feed titles or other metadata fields to persist in the database without immediate detection by standard security filters that operate during content submission.
From a technical perspective, this vulnerability exploits the separation between data storage and data rendering. When an authenticated attacker with contributor-level access or higher configures a loop block to pull from a maliciously controlled RSS feed, they can inject arbitrary web scripts into the title field of items within that feed. Since WordPress typically sanitizes content upon saving posts directly entered by users, it does not apply these same rigorous checks to dynamic content fetched and rendered later from external sources. Consequently, when an administrator or another user views a page containing this loop block, the browser executes the injected scripts in the context of the victim's session. This execution environment allows attackers to perform actions on behalf of the victim, steal sensitive cookies or authentication tokens, deface websites, or redirect users to malicious sites. The impact is particularly severe because it requires only contributor-level privileges to exploit, which are commonly granted to content creators and editors who may not be fully aware of security implications related to external data sources.
The operational impact of this vulnerability extends beyond simple script execution. Attackers can leverage the stored nature of the XSS payload to create persistent threats that affect multiple users over time. Each time a page with the compromised loop block is loaded, the malicious code executes, potentially leading to widespread compromise if high-traffic pages are targeted. Furthermore, because the attack vector involves RSS feeds which are often used for automated content aggregation and syndication, an attacker could propagate this vulnerability across multiple sites that subscribe to the same feed source. This amplifies the risk significantly in environments where news or blog content is automatically pulled from various external sources without manual review of every individual item's metadata. The ability to execute scripts with the privileges of any viewing user means that even low-privilege users can be tricked into performing administrative actions if they view a compromised page, effectively escalating their access through social engineering combined with technical exploitation.
To mitigate this vulnerability, immediate action is required by upgrading Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to version 5.2.11 or later where the issue has been addressed. Developers and site administrators should ensure that output escaping is applied consistently not just at save time but also during render time for all dynamic content sourced from external feeds. Implementing strict Content Security Policy headers can help mitigate the impact of any remaining XSS vectors by restricting script execution sources. Additionally, organizations should review their user privilege assignments to adhere to the principle of least privilege, ensuring that only trusted users with administrator-level access can configure loop blocks or manage RSS feed integrations. Regular security audits and penetration testing focused on input validation for external data sources are recommended practices to prevent similar issues in future updates or other plugins handling untrusted third-party content.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-79 Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting, and specifically relates to stored XSS where the malicious script is permanently stored on the target server. In terms of the MITRE ATT&CK framework for enterprise security, this exploit maps to techniques involving Client-side Injection such as Stored Cross-Site Scripting (T1059.007) and potentially Taint-and-Check Failure if considering the root cause in input validation logic. Understanding these mappings helps security teams categorize the threat correctly within their broader vulnerability management programs and prioritize remediation efforts based on industry-standard risk assessments.