radgeek vulnerabilities and threats

FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored Cross-Site Scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization is insufficient, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users access the injected pages.

The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.