CVE-2026-13252: Stored XSS in RSS Aggregator by Feedzy WordPress Plugin (v5.2.1)

Technical summary

CVE-2026-13252 is a stored XSS vulnerability in the RSS Aggregator by Feedzy plugin caused by insufficient input sanitization and output escaping on the 'aspectRatio' attribute. The flaw allows authenticated attackers with contributor-level or higher privileges to persist arbitrary JavaScript payloads. Because the injected content is stored server-side and rendered without proper encoding, every subsequent page view by any user triggers execution of the malicious script in the context of the WordPress site. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

This vulnerability creates a persistent threat to website visitors and site integrity. Attackers with contributor access (a common role in multi-author sites, guest authors, or agencies managing client sites) can compromise all users who view affected pages, including administrators. Potential impacts include credential theft, malware distribution, defacement, unauthorized administrative actions, and loss of visitor trust. For content-heavy WordPress installations using RSS feeds, the risk surface is substantial since RSS aggregator content typically reaches multiple users.

Affected systems

All versions of the RSS Aggregator by Feedzy plugin up to and including version 5.2.1 are affected. This includes WordPress installations with the plugin active, regardless of theme or other installed plugins. Sites allowing contributor-level or higher user roles are at direct risk. Any WordPress multisite installation where contributors can publish aggregated content is vulnerable.

Exploitability

Exploitation requires valid WordPress authentication with contributor-level access or above. This is not a zero-day scenario and does not require network-level access or advanced techniques. An attacker needs only to craft a feed or directly edit content containing malicious JavaScript in the aspectRatio field. The attack executes automatically when pages are viewed—no user interaction is needed beyond normal site browsing. The CVSS vector (AV:N/AC:L/PR:L) confirms network accessibility with low attack complexity, though privileges are required.

Remediation

Update the RSS Aggregator by Feedzy plugin to a patched version released after 5.2.1. Plugin developers should have released a security update addressing input sanitization and output escaping for the aspectRatio attribute. Verify the latest available version in the WordPress Plugin Repository or consult the plugin vendor's security advisories. As an interim measure, restrict contributor-level permissions to trusted users only and disable the plugin if an update is not immediately available.

Patch guidance

Check the WordPress Plugin Repository or the plugin vendor's official channels for version 5.2.2 or later. Verify release notes explicitly mention a fix for stored XSS in the aspectRatio parameter. Test the update in a staging environment first, as plugin updates can occasionally affect feed rendering or layout. Once confirmed safe, deploy to production and clear any cached pages to ensure the malicious payloads (if present) are not served from cache.

Detection guidance

Monitor WordPress logs for authenticated edits or uploads to RSS feed settings by users with contributor or editor roles, particularly those modifying aspectRatio values with suspicious syntax (script tags, event handlers, HTML entities). Check the WordPress post meta and RSS feed configuration tables for payloads containing 'script', 'onerror', 'onload', or other event attributes. In site inspection, view page source and search for unescaped JavaScript in aspectRatio fields. If a breach is suspected, review user activity logs and audit all published posts/pages that reference RSS feeds.

Why prioritize this

Although the CVSS score of 6.4 is medium, the practical risk is significant in WordPress environments. Stored XSS affecting all site visitors, combined with the likelihood that many sites have multiple contributors or guest authors, elevates real-world priority. The attack requires minimal sophistication, leaves persistent evidence in the database, and can propagate harmful content at scale. This should be prioritized ahead of lower-impact vulnerabilities, especially for public-facing sites.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a network-accessible vulnerability requiring low attack complexity and user privileges, with confined scope and confidentiality/integrity impact but no availability impact. The 'Medium' rating accounts for the authenticated requirement; however, the stored nature and automatic execution upon page view elevate business risk. Organizations should treat this as a high-priority patch despite the medium CVSS, given the ease of exploitation by internal or trusted users and the broad blast radius to all site visitors.

Frequently asked questions