CVE-2026-109207: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Description
The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'media:thumbnail@url' parameter. This affects all versions up to and including 5.2.11. An unauthenticated attacker who controls an external RSS feed configured on the target site can inject malicious scripts that execute when users access the affected pages. No special WordPress permissions or plugin configurations are required beyond having the vulnerable plugin and the external feed set up.
CVSS v3.1
Score 7.2high
Affected software
themeisle
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109207 is a stored cross-site scripting vulnerability (CWE-79) in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin. The flaw arises from insufficient input sanitization and output escaping of the 'media:thumbnail@url' parameter in RSS feeds imported by the plugin. This allows unauthenticated attackers who control an external RSS feed already configured on the target site to inject arbitrary web scripts that execute in the context of users visiting the affected pages. The vulnerability affects all plugin versions from 0 through 5.2.11 inclusive.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary scripts in the browsers of users visiting pages that display the injected RSS feed content. This can lead to theft of user credentials, session hijacking, or other malicious actions performed with the user's privileges. The vulnerability requires no authentication and no special plugin configuration beyond having the vulnerable plugin and an attacker-controlled RSS feed configured for import.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, avoid importing RSS feeds from untrusted or attacker-controlled sources. Monitor for plugin updates from themeisle and apply them promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-10-12T13:28:50.946Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad1a22c2cdf04f656b2c8b3
Added to database: 10/16/2026, 04:03:56 UTC
Last enriched: 10/16/2026, 04:18:31 UTC
Last updated: 10/16/2026, 04:19:13 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.