CVE-2026-110530

Name of the Vulnerable Software and Affected Versions FeedWordPress versions prior to 2026.0518

Description Stored Cross-Site Scripting occurs via syndicated RSS/Atom feed content. The SyndicatedPost::sanitize content() function fails to strip style and on[a-z]+ event-handler attributes. Additionally, the SyndicatedPost::insert post() function removes the wp filter kses and wp filter post kses filters from content save pre before persisting imported feed items. This allows unauthenticated attackers controlling an external feed to inject arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update FeedWordPress to a version later than 2026.0517.