Cpe:2.3:a:themeisle:rss_aggregator_by_feedzy:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3athemeislerss_aggregator_by_feedzywordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 04:24:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in RSS Aggregator by Feedzy WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-feedzy-xss/Fri, 16 Oct 2026 04:24:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-feedzy-xss/The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.The RSS Aggregator by Feedzy plugin for WordPress (versions 5.2.11 and below) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the processing of the 'media:thumbnail@url' parameter of imported RSS feeds. Due to insufficient input sanitization and output escaping, an attacker who controls an external RSS feed can inject arbitrary JavaScript. When the target site imports this feed and a user views the resulting post or feed display, the injected script executes in the victim's browser. This attack is particularly effective as it requires no authentication on the target WordPress instance, relying instead on the existing configuration of the Feedzy plugin to pull content from an attacker-controlled external source. This vulnerability could lead to session hijacking, site defacement, or unauthorized actions performed on behalf of authenticated administrators or users.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator or visitor's session, potentially resulting in full administrative site compromise, session theft, or the redirection of users to malicious content. The vulnerability affects all WordPress sites utilizing Feedzy versions 5.2.11 or earlier, which is a widely used plugin for automated content aggregation.

Recommendation

  • Update the "RSS Aggregator by Feedzy" plugin to the latest version immediately to remediate the sanitization deficiency in the 'media:thumbnail@url' processing.
  • Implement a strict Content Security Policy (CSP) to mitigate the impact of XSS by restricting the sources from which scripts can be loaded and preventing the execution of inline scripts.
  • Review existing configured RSS sources within the plugin settings to identify and remove any feeds that are not explicitly trusted or maintained by the organization.
]]>highadvisoryweb-application-vulnerabilitywordpressxss