CVE-2026-110707 in RSS Aggregator Plugin
Summary
by MITRE • 10/29/2026
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator for WordPress represents a significant security risk due to its potential for stored cross-site scripting attacks. This flaw exists within all versions up to and including 5.2.12 of the plugin. The core issue stems from insufficient input sanitization and output escaping mechanisms when processing specific XML elements, particularly media:group/media:description found in imported RSS feeds. Because this data is stored directly into the WordPress database without adequate validation or encoding, it becomes a persistent vector for malicious code injection that can affect multiple users over time rather than just the initial attacker.
From a technical perspective, the vulnerability allows unauthenticated attackers to inject arbitrary web scripts by manipulating the content of an RSS feed they control. When an administrator configures a Feed-to-Post import pointing at this malicious feed URL and triggers the import process through standard actions such as Run Now or during setup wizard configuration, the unsanitized script tags are saved into the database. Subsequently, whenever any user accesses pages where this content is rendered, the injected scripts execute in their browser context. This execution occurs within the trusted domain of the WordPress site, allowing attackers to bypass same-origin policy restrictions and potentially hijack user sessions or perform actions on behalf of authenticated users with higher privileges.
The operational impact of this vulnerability extends beyond simple script injection due to its stored nature. Since the malicious code is persisted in the database, it affects every visitor who views content containing the injected payload. This can lead to severe consequences including session hijacking, where attackers steal administrator cookies to gain full control over the WordPress installation; keylogging capabilities that capture sensitive credentials entered by users; and defacement of website content. The requirement for an administrative action to trigger the import does not mitigate the risk significantly because administrators routinely manage feed imports as part of standard operational workflows, making successful exploitation highly probable in environments where external feeds are regularly ingested.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known commonly as cross-site scripting. The attack vector is categorized under ATT&CK technique T1059, specifically Command and Scripting Interpretation via JavaScript execution in a browser context. Furthermore, the persistence mechanism corresponds to data injection techniques that allow attackers to maintain long-term access or influence over user interactions without requiring repeated exploitation attempts for each victim.
Mitigation strategies must focus on immediate remediation through software updates as well as defensive configuration changes. The primary and most effective mitigation is upgrading the Feedzy plugin to version 5.2.13 or later, where developers have addressed the input sanitization and output escaping deficiencies. In cases where updating is not immediately feasible, administrators should restrict access to feed import functionalities by limiting who can configure automated imports. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking XSS payloads in XML content can provide an additional layer of defense. Regular auditing of imported feeds for unexpected script tags and enforcing strict Content Security Policy headers on the WordPress site can further reduce the impact if exploitation occurs.