The vulnerability resides in the Feedzy RSS Aggregator plugin for WordPress versions up to 5.2.13, allowing unauthenticated attackers to store malicious JavaScript in a feed item title. Because the plugin parses the <item><title> element without proper sanitization, the injected code is rendered when any site visitor views a page that includes the imported feed. Thus any user who accesses the affected page or post can be exposed to remote script execution, potentially leading to session hijacking, defacement, or further compromise.

The issue impacts WordPress installations that have the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin installed, with a version of 5.2.13 or earlier. Any site where an administrator has created a Feed‑to‑Post import that points to an external feed—particularly one controlled by an attacker—can be compromised. Versions 5.2.14 and later contain the fix, so they are not affected.

The CVSS score of 5.4 places the vulnerability in the medium severity range. An attacker does not need credentials to inject the payload; however, the initial configuration requires an administrator to set a feed source that the attacker can control. Once set, the attacker can repeatedly emit different scripts without additional interaction. Because the exploit is a stored XSS, anyone who views the affected content will run the code, giving the attacker the same abilities as a standard XSS attack, such as stealing cookies or defacing the site. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, implying no known widespread exploitation at present, but the attack path remains realistic for attackers with minimal effort once the feed import is in place.