CVE-2026-13252: RSS Aggregator Feedzy XSS Vulnerability

CVE-2026-13252 Overview

CVE-2026-13252 is a Stored Cross-Site Scripting (XSS) vulnerability in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress. The flaw affects all versions up to and including 5.2.1 and stems from insufficient input sanitization and output escaping on the aspectRatio attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. Those scripts execute in the browser of any user who accesses an injected page. The vulnerability is tracked under [CWE-79].

Critical Impact
Contributor-level accounts can persist JavaScript payloads on published pages, enabling session theft, privilege escalation via administrator interaction, and defacement of any visitor's rendered page.

Affected Products

RSS Aggregator by Feedzy WordPress plugin, all versions through 5.2.1
WordPress sites permitting contributor-level or higher accounts to use Feedzy blocks or shortcodes
Sites rendering Feedzy feed output on public pages

Discovery Timeline

2026-07-02 - CVE-2026-13252 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13252

Vulnerability Analysis

The vulnerability resides in the Feedzy admin abstract handling of the aspectRatio attribute passed to feed rendering routines. The plugin accepts the attribute from authenticated user input but fails to sanitize the value on save and does not escape it on output. When the attribute is later reflected into the page markup, arbitrary attacker-controlled content is emitted into the HTML context. Authenticated attackers with contributor privileges can embed a Feedzy block or shortcode carrying a malicious aspectRatio payload. Once an editor, administrator, or visitor loads the affected page, the injected script executes with the same origin as the WordPress site. Referenced code paths include the abstract admin handler at lines 423, 624, 1453, and 1700 of feedzy-rss-feeds-admin-abstract.php, per the WordPress Feedzy RSS Code Line references.

Root Cause

The root cause is missing input sanitization and missing output escaping on the aspectRatio attribute. WordPress provides helpers such as sanitize_text_field() for storage and esc_attr() for rendering into HTML attributes. The affected code paths did not apply these helpers, allowing quote-breaking payloads and inline event handlers to persist and render verbatim.

Attack Vector

An authenticated attacker with contributor-level access creates or edits a post containing a Feedzy block or shortcode. The attacker supplies a crafted aspectRatio value containing an HTML-breaking payload with an inline JavaScript handler. After the post is submitted, the payload is stored in post content or postmeta. When any user renders the page, the browser executes the injected script under the site's origin, providing access to cookies and the DOM.

See the Wordfence Vulnerability Analysis and the fix in the WordPress Feedzy RSS Changeset for technical details.

Detection Methods for CVE-2026-13252

Indicators of Compromise

Posts or postmeta entries containing Feedzy shortcodes or blocks with unusual aspectRatio values containing quotes, angle brackets, or on* event handler substrings.
Outbound HTTP requests from browsers viewing WordPress pages to attacker-controlled hosts referenced in injected scripts.
Newly created or modified contributor accounts that authored posts embedding Feedzy elements shortly before the incident window.

Detection Strategies

Scan the wp_posts and wp_postmeta tables for the string aspectRatio combined with characters such as ", <, or javascript:.
Review WordPress audit logs for post edits by contributor-role accounts that include Feedzy blocks.
Deploy a web application firewall rule to flag requests to admin-ajax.php or the block editor REST endpoints with aspectRatio parameters containing script-like tokens.

Monitoring Recommendations

Monitor page rendering with Content Security Policy (CSP) violation reports to surface unexpected inline script execution.
Track user role assignments and detect privilege changes following contributor account activity.
Alert on plugin file changes and unauthorized modifications to Feedzy plugin files under wp-content/plugins/feedzy-rss-feeds/.

How to Mitigate CVE-2026-13252

Immediate Actions Required

Update the Feedzy RSS Aggregator plugin to a version newer than 5.2.1 that includes the fix from the referenced changeset.
Audit contributor and author accounts and remove or reset any accounts that are unrecognized or unnecessary.
Review existing posts using Feedzy blocks or shortcodes and remove any suspicious aspectRatio attribute values.

Patch Information

The vendor addressed the issue in the changeset published at WordPress Feedzy RSS Changeset. The fix adds proper sanitization and escaping of the aspectRatio attribute in feedzy-rss-feeds-admin-abstract.php. WordPress administrators should apply the update through the Plugins dashboard or via WP-CLI.

Workarounds

Restrict contributor and higher role assignments to trusted users until the patch is applied.
Disable the Feedzy plugin on public sites where an immediate update is not possible.
Deploy a Content Security Policy that disallows inline script execution to reduce the impact of stored XSS payloads.

bash

# Update Feedzy plugin using WP-CLI
wp plugin update feedzy-rss-feeds

# Verify installed version is above 5.2.1
wp plugin get feedzy-rss-feeds --field=version

# Search the database for suspicious aspectRatio values
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%aspectRatio%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror=%');"