WordPress plugin
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium18
- Low0
All RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator vulnerabilities
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Feed Item Title
≤5.2.13Update to 5.2.14
- Medium4.7Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
≤5.2.12Update to 5.2.13
- High7.2Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
≤5.2.11Update to 5.2.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
≤5.2.10Update to 5.2.11
- Medium4.3Missing Authorization to Authenticated (Author+) Cross-User Import Job Manipulation and Post Deletion
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
≤5.2.4Update to 5.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute
≤5.2.1Update to 5.2.2
- Medium4.3Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions
≤5.1.7Update to 5.1.8
- Medium5.8Unauthenticated Blind Server-Side Request Forgery
≤5.1.1Update to 5.1.2
- Medium5.0Authenticated (Subscriber+) Server-Side Request Forgery
≤5.1.0Update to 5.1.1
- Medium6.4Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)
≤4.4.7Update to 4.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message
≤4.3.3Update to 4.3.4
- Medium6.5Missing Authorization to Arbitrary Page Creation and Publication
≤4.4.2Update to 4.4.3
- High8.8Authenticated(Contributor+) SQL Injection
≤4.4.2Update to 4.4.3
- Medium4.3Missing Authorization
≤4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
≤2.6.9Update to 2.6.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤4.3.2Update to 4.3.3
- Medium5.4Missing Authorization
≤4.3.2Update to 4.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.1.0Update to 4.1.1
- Medium4.3Cross-Site Request Forgery Bypass
<3.4.3Update to 3.4.3
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: common questions
Does RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: 2 high, 18 medium. None are known to affect version null.
How do I check which version of RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator vulnerability?
CVE-2026-120035, published Nov 5, 2026: RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title. Severity: Medium (CVSS 5.4).
Is any RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator vulnerability listed in CISA KEV?
No. None of the known RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator vulnerabilities is currently listed in the CISA KEV catalog.