Feedzy RSS Feeds CVE-2026-109207

Exploitation requires the attacker to control the content of an external RSS feed that the target site has ALREADY configured for import in Feedzy; the malicious payload must be placed in the 'media:thumbnail@url' field of a feed item, which the plugin imports and renders without sufficient sanitization/output escaping. No WordPress account, authentication, or special non-default plugin configuration is required beyond the site having subscribed to the attacker-controllable feed. Key limiting factors: the target must already import from a feed the attacker can influence (compromise or operate), and the payload executes only when a user accesses the generated/injected page, so sites that only aggregate trusted first-party feeds face substantially reduced real-world risk.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) presents this as a network-exploitable, unauthenticated, scope-changing issue, which on paper looks like a high priority. However, the description introduces a significant mitigating precondition not reflected in the vector: the attacker must already control an external RSS feed that the target site has configured for import. This is effectively a non-trivial attack requirement that the AC:L rating does not capture - in practice exploitation is gated on the victim having subscribed to attacker-influenced content, so AC:H would arguably be more honest. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or imminent widespread exploitation - this is a stored XSS in a WordPress plugin rather than a server-side RCE. Net assessment: a genuine but context-dependent vulnerability that should be patched (5.2.12 is available), prioritized below unauthenticated RCE or SQLi, with real risk concentrated on sites that aggregate feeds from untrusted or attacker-controllable sources. No exploitation-probability (EPSS) signal is available to refine urgency - absence of that data is noted, not treated as low risk.

An attacker sets up or compromises an RSS feed that a target WordPress site has configured for automatic import via Feedzy, then publishes a feed item whose 'media:thumbnail@url' value contains a malicious script payload. When Feedzy imports the item and the content is rendered on a generated page, the unsanitized script executes in the browser of any visitor or administrator who views that page, enabling session theft or admin-context actions. No public exploit code is identified at time of analysis, and exploitation depends on the target already trusting the attacker-influenced feed.