Feedwordpress
Monthly
Stored cross-site scripting in the FeedWordPress WordPress plugin, affecting all versions up to and including 2026.0517, allows an attacker who controls or can poison an RSS/Atom feed that a site already syndicates to plant script-bearing markup that is persisted into imported posts and executes when a user views them. No site authentication is required (CVSS PR:N), and the score carries a scope change (S:C) because the injected script runs in the context of the victim WordPress site rather than the external feed. The practical prerequisite is a pre-existing subscription to an attacker-influenced feed, so exposure is limited to sites syndicating untrusted sources; no public exploit has been identified at time of analysis, and priority is rated this_week rather than emergency.
The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stored cross-site scripting in the FeedWordPress WordPress plugin, affecting all versions up to and including 2026.0517, allows an attacker who controls or can poison an RSS/Atom feed that a site already syndicates to plant script-bearing markup that is persisted into imported posts and executes when a user views them. No site authentication is required (CVSS PR:N), and the score carries a scope change (S:C) because the injected script runs in the context of the victim WordPress site rather than the external feed. The practical prerequisite is a pre-existing subscription to an attacker-influenced feed, so exposure is limited to sites syndicating untrusted sources; no public exploit has been identified at time of analysis, and priority is rated this_week rather than emergency.
The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.