Description
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-10-31
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting that allows an attacker to execute arbitrary scripts in the browsers of site visitors
Action: Apply Patch
AI Analysis

Impact

The FeedWordPress plugin for WordPress contains a stored cross‑site scripting flaw in versions up to and including 2026.0517. The sanitization routine only removes the target attribute and deliberately bypasses WordPress’s built‑in content filtering, enabling an attacker to inject malicious JavaScript into feed‑generated posts that will execute whenever a user views the page.

Affected Systems

The affected system is the FeedWordPress plugin for WordPress. All releases up to and including version 2026.0517 are vulnerable; newer releases such as 2026.1016 contain the fix.

Risk and Exploitability

The CVSS score of 7.2 indicates a high impact level. Although the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated attacker controlling an external RSS/Atom feed that the site subscribes to, allowing the injection of arbitrary scripts into imported content. If exploited, the flaw can compromise the integrity and confidentiality of user sessions and potentially facilitate further attacks on the site or its visitors.

Generated by OpenCVE AI on October 31, 2026 at 09:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FeedWordPress plugin to version 2026.1016 or newer to restore proper sanitization and re‑enable WordPress’s content filtering.
  • Delete any posts that were imported from untrusted external feeds before the upgrade to remove previously injected malicious content.
  • Remove or disable subscriptions to external feeds that originate from untrusted or unknown sources to prevent future injection attempts.

Generated by OpenCVE AI on October 31, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 31 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Description The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-31T08:30:47.249Z

Reserved: 2026-10-14T12:52:03.854Z

Link: CVE-2026-110530

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-31T09:16:32.933

Modified: 2026-10-31T09:16:32.933

Link: CVE-2026-110530

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-31T09:30:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')