EUVD-2026-13991
GHSA-pmq6-5285-2f6f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Alfie - Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Alfie - Feed Plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'naam' parameter of the alfie_option_page() function, affecting all versions up to and including 1.2.1. The vulnerability stems from missing nonce validation combined with insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that persist in the plugin's database and execute when users view affected pages. An attacker must successfully social engineer a site administrator into clicking a malicious link, but once exploited, the payload executes with the privileges of any user accessing the compromised page, making this a moderate-risk vulnerability with a CVSS score of 6.1.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), which occurs when user input is not properly sanitized before being stored and rendered in the browser. The affected product, identified via CPE as cpe:2.3:a:pftool:alfie_–_feed_plugin:*:*:*:*:*:*:*:*, is a WordPress plugin that handles product feed management. The root cause involves two critical security failures in the alfie-option.php file (lines 59-60 and 75): the alfie_option_page() function lacks WordPress nonce verification (used to prevent Cross-Site Request Forgery), and the 'naam' parameter is processed without proper sanitization before database storage or escaping before output rendering. WordPress provides built-in functions like sanitize_text_field() for input sanitization and esc_html() or esc_attr() for output escaping that should be employed but are absent in this implementation.
RemediationAI
WordPress site administrators must upgrade the Alfie – Feed Plugin to a version newer than 1.2.1 immediately, as that version is the last confirmed vulnerable release (verify availability of patched version through the official WordPress plugin repository at plugins.wordpress.org/alfie-the-productfeedtool-wp-plugin). Until a patch is available or deployed, administrators should deactivate and remove the plugin entirely if not in active use, or if the plugin is critical to operations, restrict administrative access to the plugin settings page through WordPress user capability restrictions and implement Web Application Firewall (WAF) rules to detect and block stored XSS payloads in POST requests to the affected parameter. Additionally, regular security audits of the WordPress database should be performed to identify any existing malicious 'naam' parameter values that may have been injected and subsequently removed via database cleanup scripts.
More in Alfie Feed Plugin
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today