Stored cross‑site scripting is caused by insufficient sanitization of the media:description XML element in imported feeds. After an administrator imports a feed, malicious script stored in that element is rendered in the site’s front‑end, causing the script to run in any visitor’s browser.

The issue affects the WordPress plugin RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator from vendors themeisle, in all releases up to and including 5.2.12.

With a CVSS score of 4.7, this vulnerability is considered medium. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker that can supply a malicious feed URL can inject scripts that execute whenever any site visitor loads the affected content; however, the attacker needs the site administrator to trigger the import, limiting the attack window. The primary attack vector is remote, contingent on an unauthenticated attacker controlling a feed and the administrator executing the import.