We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerability (CVE-2026-120035)

Nick Paliughi
On this page

Security Alert Summary

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability in the handling of feed item titles. Insufficient input sanitization and output escaping for the item_title parsed from a feed’s <item><title> element can allow an attacker to inject scripts that execute when a user views an injected page. Exploitation requires a previously configured Feed-to-Post import pointing at an attacker-controlled feed URL.

CVE Details

  • CVE ID: CVE-2026-120035
  • Affected component: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress
  • Affected versions: All versions up to and including 5.2.13
  • Published: November 6, 2026 at 12:17:20 PM UTC
  • Last modified: November 6, 2026 at 3:17:13 PM UTC
  • CVSS v3.1 base score: 5.4 (MEDIUM)
  • CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction:
    • Authentication required: None (unauthenticated attacker may supply feed content)
    • Privileges required: None
    • User interaction: None
    • Attack complexity: High
    • Attack vector: Network
    • Scope: Changed
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • CWE / weakness ID: CWE-79 (Cross-site Scripting)

Technical Details

This is a stored XSS vulnerability that occurs when the plugin parses the feed <item><title> into the item_title parameter without sufficient input sanitization and without proper output escaping. An attacker who can serve a malicious feed to a configured Feed-to-Post import can include JavaScript payloads inside the title element. Because the plugin stores or outputs the parsed title in pages viewed by other users, the injected script will execute when those pages are accessed.

The issue requires an administrator (or other user with access to plugin configuration) to have previously configured an import pointing to an attacker-controlled feed URL; after that initial configuration the attacker can rotate payloads in the feed. Code references in the provided advisory point to admin and import-related files in the plugin codebase for version 5.2.13 (for example, files under includes/admin/ and includes/abstract/ in the tagged 5.2.13 tree).

Impact is limited to what injected scripts can achieve in the context of pages where the title is rendered. The vulnerability does not, by itself, indicate remote code execution on the server or direct compromise of the WordPress installation beyond what a successful stored XSS can accomplish in the browser context of affected pages.

How This Could Impact Your Website

Imagine a small editorial team where the site owner configures a Feed-to-Post import, an internal editor reviews incoming posts, and an external contractor contributes content or edits. If an attacker controls a feed URL used by the import, they can inject script payloads into feed item titles. When editors or contractors view the affected post listings or pages, those scripts can execute in their browsers.

Practical consequences include exposure of internal user session data or email addresses visible in the page context, or the attacker performing actions in the victim’s browser (for example, stealing authentication cookies or performing unwanted requests within the scope of the user). This increases the risk of targeted phishing or social-engineering campaigns against staff whose information or activity becomes exposed.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles and permissions, especially contributor-level accounts.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins and audit plugin settings that accept external content.
  • Monitor site activity and access logs for unusual behavior or repeated requests to import endpoints.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Live2DWebCanvas Plugin Vulnerability (CVE-2026-92895)
Next Post
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (CVE-2026-89101)