CVE-2026-120035: RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'itemtitle (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.
Event History
Frequently Asked Questions
Which sites are realistically exposed to exploitation?
A site is exposed if it uses an affected version and an administrator has configured a Feed-to-Post import that retrieves content from an attacker-controlled feed URL. Sites without such an import configuration are not described as exploitable through this issue.
What does an attacker need to exploit this vulnerability?
The attacker does not need authentication, but needs control of the RSS feed URL already configured in a Feed-to-Post import. They can place script payloads in feed item titles and rotate those payloads without further interaction with the site once the import is configured.
When does the injected script execute?
The script is stored in imported content and executes when a user accesses an injected page. The vulnerability affects confidentiality and integrity, but no availability impact is identified in the supplied severity vector.
What can be done if patching is not immediately possible?
Review Feed-to-Post imports and disable or remove any that point to untrusted or attacker-controlled feed URLs. This removes the stated prerequisite that allows an unauthenticated attacker to supply malicious item titles.