CVE-2025-11128: Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11128?
CVE-2025-11128 is classified as a moderate severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2025-11128?
To fix CVE-2025-11128, update the Feedzy RSS Feeds Lite plugin to version 5.1.1 or later.
What versions are affected by CVE-2025-11128?
CVE-2025-11128 affects all versions of Feedzy RSS Feeds Lite up to and including 5.1.0.
What is the impact of CVE-2025-11128?
CVE-2025-11128 allows for server-side request forgery, potentially exposing sensitive information.
Who is the vendor behind the CVE-2025-11128 vulnerability?
The vendor associated with CVE-2025-11128 is Feedzy, known for the RSS Feeds Lite plugin.