CVE-2025-11128

Name of the Vulnerable Software and Affected Versions Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to and including 5.1.0

Description The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is susceptible to Server-Side Request Forgery. This allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the web application. This can be used to query information from internal services via the feedzy sanitize feeds function.

Recommendations Update Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress to a version later than 5.1.0.