CVE-2026-109207

Name of the Vulnerable Software and Affected Versions RSS Aggregator by Feedzy versions prior to 5.2.12

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the media:thumbnail@url parameter. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them, provided the attacker controls an external RSS feed already configured for import by the target site.

Recommendations Update RSS Aggregator by Feedzy to version 5.2.12 or later.