The Feedzy RSS Aggregator plugin for WordPress contains a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript through the media:thumbnail@url parameter of an RSS feed. When users view a page that displays the injected content, the script runs in their browsers, potentially stealing session cookies, defacing content, or executing further malicious actions. The vulnerability can be leveraged without authentication and does not require special plugin settings beyond a configured RSS source.

Themeisle’s Feedzy RSS Aggregator – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator for WordPress, all releases up to and including version 5.2.11 are affected. Any WordPress site running a vulnerable installation of this plugin is at risk and may have previously imported malicious RSS entries.

The CVSS score of 7.2 indicates a high severity of the issue. Although an EPSS score is not available, the attack can be executed simply by controlling an external RSS feed that the site imports, with no need for user authentication or privileged access. The vulnerability is not listed in the CISA KEV catalog, but its impact and ease of exploitation make it a serious threat to sites using the affected plugin.