CVE-2026-110530: FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

Q: Which sites are exposed to exploitation?

Sites using an affected FeedWordPress version are exposed only if they have already subscribed to an RSS or Atom feed controlled by an attacker. The attacker does not need a WordPress account or other authentication on the target site.

Q: What must happen for the injected script to run?

The attacker must publish malicious content in a feed the site imports through FeedWordPress. The script is stored in the imported post and executes when a user accesses the injected page.

Q: Are imported feed posts protected by WordPress content sanitization?

No. During import, FeedWordPress removes the wp_filter_kses and wp_filter_post_kses content-save filters before storing the post, while its own sanitization only strips the target attribute and leaves style and event-handler attributes unfiltered.

Published Oct 31, 2026

Updated

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insertpost() deliberately removes WordPress's wpfilterkses and wpfilterpostkses filters from contentsavepre before persisting imported feed items via wpinsertpost(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Event History

Oct 31, 2026

CVE Published

via MITRE·08:30 AM

Data Sourced

via MITRE·08:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to exploitation?

Sites using an affected FeedWordPress version are exposed only if they have already subscribed to an RSS or Atom feed controlled by an attacker. The attacker does not need a WordPress account or other authentication on the target site.

What must happen for the injected script to run?

The attacker must publish malicious content in a feed the site imports through FeedWordPress. The script is stored in the imported post and executes when a user accesses the injected page.

Are imported feed posts protected by WordPress content sanitization?

No. During import, FeedWordPress removes the wp_filter_kses and wp_filter_post_kses content-save filters before storing the post, while its own sanitization only strips the target attribute and leaves style and event-handler attributes unfiltered.

CVE-2026-110530: FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

Event History

Frequently Asked Questions

Which sites are exposed to exploitation?

What must happen for the injected script to run?

Are imported feed posts protected by WordPress content sanitization?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to exploitation?

What must happen for the injected script to run?

Are imported feed posts protected by WordPress content sanitization?