CVE-2026-13252 is a stored cross-site scripting vulnerability in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin. The flaw exists in the handling of the 'aspectRatio' attribute, where input is not properly sanitized or escaped before being rendered on web pages. Authenticated attackers with contributor-level privileges or above can exploit this to inject arbitrary scripts that execute in the context of users viewing the injected content. The vulnerability affects all versions up to and including 5.2.1.

Successful exploitation allows an attacker with contributor-level access to execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure, session hijacking, or other actions permitted by the victim's privileges. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Monitor for updates from the vendor themeisle regarding an official fix or mitigation steps.