CVE-2026-120035 in RSS Aggregator Plugin
Summary
by MITRE • 11/06/2026
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as CVE-2024-XXXX affects the RSS Aggregator plugin by Feedzy for WordPress, specifically impacting all versions up to and including 5.2.13. This security flaw is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's handling of RSS feed data. Specifically, the vulnerability targets the item_title parameter, which is derived from the title element found within an RSS feed's <item> tags. When a WordPress administrator configures a Feed-to-Post import to pull content from a specific URL, the plugin processes this external data without adequately validating or encoding it before storing and displaying it on the website.
The operational impact of this vulnerability is significant due to its stored nature. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, stored XSS persists in the application's database. In this scenario, an attacker controls the source RSS feed URL rather than directly interacting with the vulnerable WordPress site after initial setup. Once an administrator has configured the plugin to import from a feed controlled by the attacker, any content published via that feed is rendered on the target website without proper sanitization. This allows the attacker to inject arbitrary JavaScript code into pages viewed by legitimate users. The attack chain begins when the administrator sets up the integration, after which the attacker can rotate payloads at will without needing further access or interaction with the WordPress installation itself.
From a tactical perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, JavaScript Scripting, and falls under the broader category of Injection attacks (T1190). The persistence mechanism is particularly dangerous because it enables long-term compromise. An attacker can maintain access to user sessions or steal sensitive information such as cookies, session tokens, or personal data by executing scripts in the context of the victim's browser. Furthermore, this vulnerability could be leveraged for further attacks, including defacement of the website or using compromised client machines as proxies for additional malicious activities against other targets. The lack of authentication required to exploit the final execution phase means that any visitor viewing a page with an injected payload becomes a potential target.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary recommendation is to update the Feedzy RSS Aggregator plugin to version 5.2.14 or later, where these input validation and output escaping issues have been resolved by the developers. For organizations unable to patch immediately due to compatibility concerns, temporary mitigations include restricting access to feed URLs through firewall rules or web application firewalls that can detect and block malicious script injections in RSS feeds. Additionally, implementing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute. Regular audits of third-party plugins and their configurations should be conducted to ensure that only trusted feed sources are imported into the WordPress environment.