Stored XSS in RSS Aggregator by Feedzy WordPress Plugin

The RSS Aggregator by Feedzy plugin for WordPress (versions 5.2.11 and below) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the processing of the 'media:thumbnail@url' parameter of imported RSS feeds. Due to insufficient input sanitization and output escaping, an attacker who controls an external RSS feed can inject arbitrary JavaScript. When the target site imports this feed and a user views the resulting post or feed display, the injected script executes in the victim's browser. This attack is particularly effective as it requires no authentication on the target WordPress instance, relying instead on the existing configuration of the Feedzy plugin to pull content from an attacker-controlled external source. This vulnerability could lead to session hijacking, site defacement, or unauthorized actions performed on behalf of authenticated administrators or users.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator or visitor's session, potentially resulting in full administrative site compromise, session theft, or the redirection of users to malicious content. The vulnerability affects all WordPress sites utilizing Feedzy versions 5.2.11 or earlier, which is a widely used plugin for automated content aggregation.

Recommendation

• Update the "RSS Aggregator by Feedzy" plugin to the latest version immediately to remediate the sanitization deficiency in the 'media:thumbnail@url' processing.
• Implement a strict Content Security Policy (CSP) to mitigate the impact of XSS by restricting the sources from which scripts can be loaded and preventing the execution of inline scripts.
• Review existing configured RSS sources within the plugin settings to identify and remove any feeds that are not explicitly trusted or maintained by the organization.