FeedWordPress CVE-2026-110530

The target WordPress site must already have FeedWordPress configured to syndicate an RSS/Atom feed that the attacker controls or can poison - the attacker cannot force a new subscription, so a pre-existing trust relationship with the malicious/compromised feed source is the core prerequisite. Given that, no site authentication is required (PR:N): the attacker simply publishes feed-item content containing a script in a 'style' or 'on[a-z]+' event-handler attribute, which versions up to and including 2026.0517 fail to strip (those sanitizer lines are commented out) and which insert_post() persists after deliberately removing wp_filter_kses/wp_filter_post_kses from content_save_pre. Limiting factors: exploitation depends on this non-default trust in an attacker-influenced feed, and the payload only fires when a user subsequently views the imported post; it does not affect sites that do not syndicate untrusted feeds.

Signals are moderate and partially incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects an unauthenticated, network-reachable stored XSS with scope change - the injected script executes in the browsers of users/administrators viewing the imported post, beyond the vulnerable plugin component. However, raw network reachability overstates ease: exploitation is gated on the target site having already subscribed FeedWordPress to a feed the attacker controls or can poison, so this is not a spray-and-pray internet-facing flaw. No EPSS score was supplied, so exploitation probability cannot be quantified here. KEV status is not listed (treated as NO) - no confirmed active exploitation. No PoC or working exploit reference is present in the input; only the Wordfence advisory and WordPress Trac source lines are referenced, which document the mechanism but are not exploit code. The vuln.today decision label is 'this_week', indicating a near-term (not emergency) patch priority consistent with the absence of KEV/EPSS escalation. Net: a legitimate stored-XSS issue worth patching promptly, but its real-world reach is bounded by the feed-subscription precondition rather than being a mass-exploitable critical.

An attacker who controls (or compromises) an RSS/Atom feed that a WordPress site has already configured FeedWordPress to syndicate publishes a feed item whose content embeds a script via a style or on* event-handler attribute. Because versions up to 2026.0517 leave the event-handler/style stripping commented out and strip wp_filter_post_kses before insert, the payload is stored verbatim and runs in the browser of any user - including an administrator - who later views the imported post. No public exploit was identified at time of analysis; the mechanism is documented in the vendor advisory and plugin source.