CVE-2026-109207: RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
Affected Software
Event History
Frequently Asked Questions
Which sites are realistically exposed to this issue?
Sites using RSS Aggregator by Feedzy version 5.2.11 or earlier are exposed only if they have configured the plugin to import an external RSS feed that an attacker can control. A WordPress account is not required for exploitation.
What must an attacker do to exploit it?
The attacker must control an external RSS feed already configured for import by the target site and provide a malicious media:thumbnail URL. The injected script is stored and runs when someone accesses the affected imported page.
Is a special plugin configuration required?
No special plugin configuration is needed beyond importing an attacker-controlled external RSS feed. The issue stems from insufficient sanitization of the media:thumbnail@url value and insufficient escaping when it is displayed.