Description
The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-03-21
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The Alfie – Feed Plugin for WordPress embeds user‑supplied data from the 'naam' parameter directly into the database without validating a nonce or escaping the input. This flaw enables an unauthenticated attacker to inject JavaScript that is permanently stored and executed whenever the affected page is loaded. As a result, visitors or administrators who load the page can have their session data stolen, be redirected to malicious sites, or have the site defaced.

Affected Systems

WordPress sites that have the Alfie – Feed Plugin (developer: pftool) installed with version 1.2.1 or any earlier release are vulnerable. The issue exists in all releases up to and including 1.2.1; newer releases or the trunk code base do not contain the flaw.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate severity. The attack requires no authentication but relies on convincing an administrator to trigger the payload, typically by clicking on a crafted link or form. Because the malicious code is stored in the database, it persists across users and sessions, amplifying the impact. No EPSS score is currently available, and the vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on March 21, 2026 at 07:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Alfie – Feed Plugin to the latest version that removes the unsanitized 'naam' handling.
  • If an immediate upgrade is not possible, temporarily disable or uninstall the Alfie – Feed Plugin until a patched version is released.
  • Review the plugin’s database entries for any injected scripts and clear them manually.
  • Ensure administrators are aware of the risk of clicking on unfamiliar links that might trigger the vulnerable action.
  • Consider implementing a site‑wide security audit or firewall rule to block suspicious parameters to the plugin’s processing endpoints.

Generated by OpenCVE AI on March 21, 2026 at 07:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Pftool
Pftool alfie – Feed Plugin
Wordpress
Wordpress wordpress
Vendors & Products Pftool
Pftool alfie – Feed Plugin
Wordpress
Wordpress wordpress

Sat, 21 Mar 2026 05:30:00 +0000

Type Values Removed Values Added
Description The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.
Title Alfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Pftool Alfie – Feed Plugin
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:49:16.544Z

Reserved: 2026-03-12T19:41:42.490Z

Link: CVE-2026-4069

cve-icon Vulnrichment

Updated: 2026-03-23T15:07:44.277Z

cve-icon NVD

Status : Deferred

Published: 2026-03-21T04:17:40.220

Modified: 2026-04-24T16:27:44.277

Link: CVE-2026-4069

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:42:18Z

Weaknesses