CVE-2026-110530 in FeedWordPress Plugin
Summary
by MITRE • 10/31/2026
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The FeedWordPress plugin, widely used within the WordPress ecosystem to aggregate content from various syndicated RSS and Atom feeds into a single dashboard or blog view, contains a critical security flaw affecting versions up through 2026.0517. This vulnerability manifests as a Stored Cross-Site Scripting issue, which is particularly dangerous because it allows malicious scripts to be permanently embedded in the database rather than being executed transiently during a specific request. The root cause lies in how the plugin processes and sanitizes incoming feed content before storing it for display on the target WordPress site. Specifically, the SyndicatedPost::sanitize_content() function fails to adequately strip dangerous HTML attributes. While it removes the 'target' attribute, which is often used for phishing or navigation hijacking, critical security lines designed to remove style attributes and event handlers matching patterns like on[a-z]+ are commented out in the source code. This oversight means that any JavaScript events embedded within feed items, such as onload, onclick, or onerror, survive the sanitization process intact.
The severity of this vulnerability is compounded by a deliberate architectural decision made during the data persistence phase. When new posts from syndicated feeds are created via SyndicatedPost::insert_post(), the plugin intentionally removes WordPress's built-in security filters, specifically wp_filter_kses and wp_filter_post_filters, from the content_save_pre hook before calling wp_insert_post(). These core WordPress functions are designed to enforce strict HTML filtering rules that strip out potentially dangerous tags and attributes. By bypassing these safeguards, FeedWordPress ensures that its own less rigorous sanitization logic is applied instead. This creates a significant gap in defense-in-depth strategies, as the plugin effectively disables the primary line of automated security protection provided by the WordPress core for this specific type of content ingestion.
From an operational impact perspective, this vulnerability allows unauthenticated attackers who control or compromise an external RSS feed that a victim site has subscribed to to inject arbitrary web scripts into the target environment. Once injected, these scripts are stored in the database and will execute whenever any user accesses pages containing the compromised syndicated posts. This can lead to severe consequences including session hijacking, where attacker-controlled cookies are stolen to impersonate legitimate users; credential theft via phishing forms embedded within the malicious script; or defacement of the website by altering its DOM structure. Since the attack vector relies on an external feed subscription, it does not require direct access to the WordPress admin panel, making it a remote code execution risk that can affect sites with no exposed administrative interfaces if they subscribe to compromised feeds.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism of storing malicious content in the database for later retrieval and execution classifies it under Stored XSS rather than Reflected or DOM-based variants. In terms of adversary tactics, this behavior maps to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through JavaScript interpretation within a browser context. It also relates to T1189, Drive-by Client-side Execution, as the payload executes automatically upon page load without requiring further user interaction beyond viewing the post. The failure to strip event handlers is a classic example of insufficient input validation where only superficial attributes are sanitized while deeper structural threats remain unchecked.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately update FeedWordPress to version 2026.0518 or later, where the commented-out sanitization lines have presumably been re-enabled or replaced with more robust filtering logic. For sites unable to upgrade instantly, implementing a Web Application Firewall rule that blocks common XSS payloads in RSS feed responses can provide temporary relief. Additionally, enabling Content Security Policy headers on the WordPress site can help mitigate the impact of any successfully injected scripts by restricting script execution sources and preventing inline JavaScript from running unless explicitly allowed. It is also advisable for administrators to audit their subscribed feeds regularly, removing subscriptions to untrusted or rarely updated sources that may become compromised over time.