EUVD-2026-41268
GHSA-95qw-x29w-3qx6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload fires only when a victim visits the injected page (UI:R, differing from NVD's UI:N); contributor authentication required (PR:L); scope change (S:C) reflects browser-context escalation to other users.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Feedzy RSS Aggregator WordPress plugin (all versions through 5.2.1) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via the unsanitized 'aspectRatio' attribute of the RSS feed block. When any user - including site administrators - visits a page containing the injected content, the payload executes in their browser, enabling session hijacking, credential theft, or privilege escalation to full site control. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low privilege bar (contributor) and scope change to administrator sessions make this a meaningful risk for multi-author WordPress deployments.
Technical ContextAI
The vulnerability exists within the Themeisle 'RSS Aggregator by Feedzy' WordPress plugin (CPE: cpe:2.3:a:themeisle:rss_aggregator_by_feedzy_-_feed_to_post,_autoblogging,_news_&_youtube_video_feeds_aggregator:*:*:*:*:*:*:*:*). The flaw is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize or escape the 'aspectRatio' block attribute before rendering it to HTML output. Wordfence source code references trace the unsanitized data flow through at least four distinct locations in feedzy-rss-feeds-admin-abstract.php (lines 423, 624, 1453, and 1700 in the 5.2.0 tag), indicating the attribute value traverses multiple rendering pathways without proper escaping. The plugin is a Gutenberg block editor plugin used to aggregate and embed RSS feeds and YouTube video content, where 'aspectRatio' controls video frame dimensions - a field that accepts user-supplied input but is reflected unsanitized into page markup. The S:C (Changed Scope) in the CVSS vector correctly reflects that the injection context is the contributor's authoring session, while the impact manifests in other users' browser sessions.
RemediationAI
A fix has been committed to the WordPress plugin SVN repository (changeset 3586919, visible at plugins.trac.wordpress.org/changeset?...old=3586919%40feedzy-rss-feeds&new=3586919%40feedzy-rss-feeds); however, the exact released patched version number is not independently confirmed from the available data - the upstream fix available (SVN commit) means a patched release has likely been published, but the version has not been independently verified. Update the Feedzy RSS Aggregator plugin to the latest available version via the WordPress admin dashboard (Plugins > Installed Plugins > Update) or the WordPress.org plugin directory immediately. If immediate patching is blocked, restrict contributor-level access by auditing WordPress user roles and removing the contributor role from any untrusted accounts, as this eliminates the minimum privilege required for exploitation - note this may impact legitimate editorial workflows. As a secondary compensating control, a WAF rule targeting unsanitized injection in the 'aspectRatio' parameter can intercept crafted payloads in transit; Wordfence users on patched rule sets may already have coverage. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/d402b7d1-3c12-4bdd-8ff3-e58d5501f0c0) for the confirmed fixed version once published.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today