CVE-2026-104735: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

CVE-2026-104735 is a stored cross-site scripting vulnerability in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin. The flaw exists in all versions up to and including 5.2.10 due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts via the RSS feed title in the Feedzy Loop Block. The malicious payload is not sanitized at save time because the post_content only stores a block reference to the external feed URL; the script is injected dynamically at render time from the attacker-controlled RSS feed title, bypassing wp_kses filtering.

An attacker with contributor-level access or higher can inject malicious JavaScript that executes in the context of users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's browser context. The vulnerability does not affect availability and requires authenticated access, but it compromises confidentiality and integrity of user sessions.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting the use of the Feedzy Loop Block that processes external RSS feed titles. Monitor vendor channels for updates and apply patches promptly once released.