CVE-2026-13252: RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13252?
The severity of CVE-2026-13252 is classified as medium with a score of 6.4.
How do I fix CVE-2026-13252?
To fix CVE-2026-13252, update the Feedzy RSS Aggregator plugin to version 5.2.2 or later.
What type of vulnerability is CVE-2026-13252?
CVE-2026-13252 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-13252?
Users of the Feedzy RSS Aggregator plugin on WordPress versions up to and including 5.2.1 are affected by CVE-2026-13252.
Can CVE-2026-13252 be exploited remotely?
Yes, CVE-2026-13252 can be exploited remotely due to its authenticated stored XSS nature.