Description

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T12:17:20.067Z",
  "pubdate": "2026-11-06T12:17:20.067Z",
  "executiveSummary": "The Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from improper input sanitization and output escaping within the 'item_title' parameter, derived from parsed RSS feed <item><title> tags.\nThe flaw allows unauthenticated remote attackers to inject arbitrary JavaScript payloads into the WordPress database.\nWhen an administrator or authorized user views the affected page, the malicious script executes within the context of their session.\nThe impact includes potential account takeover, session hijacking, unauthorized administrative actions, or defacement.\nSuccessful exploitation requires that an administrator has previously configured a Feed-to-Post import targeting a feed URL controlled by the attacker.\nOnce the initial feed source is established, the attacker can rotate payloads autonomously without further interaction, significantly increasing the risk profile.",
  "technicalDetails": "The vulnerability resides in the core parsing mechanism of the Feedzy plugin, specifically where the 'item_title' attribute is extracted from external RSS feeds and processed for display.\nThe application fails to apply adequate context-aware output escaping or server-side input sanitization when rendering the title content in the administrative or frontend dashboard.\nThe root cause is the trust placed in external feed data, which the plugin processes and stores as part of the content import process without adequate filtering for executable scripts.\nExploitation follows a specific attack chain: First, an attacker must identify a WordPress installation utilizing the Feedzy plugin where an administrator has configured a Feed-to-Post import task pointing to an attacker-controlled RSS feed URI.\nThe attacker hosts an RSS feed containing malicious JavaScript payloads embedded within the <item><title> tags. When the plugin performs a scheduled or manual fetch operation, it parses the malicious title and stores it directly into the WordPress database.\nBecause the plugin does not escape this input upon retrieval, the malicious payload is reflected back to the browser when the page containing the feed items is rendered. This leads to Stored XSS.\nThe execution occurs when a victim, typically an administrator, navigates to the administrative interface or frontend page where the aggregator displays the compromised feed content.\nSince the script executes in the victim's browser, it gains access to the victim's session cookies, local storage, and the ability to perform background HTTP requests to the WordPress API or administrative endpoints.\nThis allows for post-exploitation actions such as creating new rogue administrative accounts, modifying site settings, or redirecting users to malicious external domains.\nThe architecture of the vulnerability allows for payload persistence; because the plugin continues to poll the attacker-controlled RSS URL, the attacker can replace existing payloads by modifying the source feed, ensuring the malicious script remains present even if specific payloads are blocked or removed from the database manually.\nThe vulnerability affects all versions of the plugin up to and including 5.2.13."
}