Feedzy RSS Aggregator EUVD-2026-96062

Requires an authenticated contributor-level (or higher) account on a WordPress site running Feedzy RSS Aggregator ≤5.2.10 that uses the Gutenberg Feedzy Loop Block. The attacker must set the block's Feed URL to an RSS source they control and embed malicious HTML in that feed's <title> element; because post_content stores only a benign block reference to the external URL, save-time wp_kses filtering never sees the payload, which is injected at render time. Limiting factors: exploitation is impossible without contributor access and the ability to host/control an RSS feed, the payload only fires when a user actually renders the affected page, and sites that do not use the Loop Block or do not grant contributor accounts are not exposed.

This is a moderate-severity stored XSS (CVSS 6.4) whose risk is bounded more by its preconditions than by its network-facing vector. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network reach, low complexity, and no user interaction, but PR:L is the key limiter: the attacker must already hold contributor-level (or higher) authenticated access, which is not available on most locked-down sites. The scope change (S:C) and C:L/I:L correctly reflect that the injected script runs in the browser of whoever views the page - potentially a higher-privileged editor or administrator, enabling session/action abuse within that user's context. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' The notable technical wrinkle is that the payload bypasses save-time wp_kses sanitization because post_content only stores a benign block reference and the malicious HTML is injected at render time from the attacker-controlled external RSS feed title - meaning standard content filtering will not catch it, raising the real-world detectability concern slightly. Overall this is a legitimate but second-tier priority: patch promptly on multi-author sites that grant contributor accounts, but it is not a drop-everything internet-wide threat given the authentication requirement and absence of exploitation signals.

An attacker with a contributor account on a WordPress site running Feedzy ≤5.2.10 configures a Feedzy Loop Block to pull from an RSS feed URL they control, whose <title> element contains a malicious script payload. When an editor or administrator later previews or publishes that page, the attacker's script executes in the privileged user's browser. No public exploit code was identified at time of analysis, but the technique is straightforward and low-complexity (AC:L).