Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Feedwordpress - Security Vulnerability (CVE-2026-110530)
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that…
PLUGIN
Feedwordpress
CVE-2026-110530
Risk Score
Threat Entry
Updated 2026-06-17
Feedwordpress - Information Disclosure (CVE-2024-0839)
The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.
PLUGIN
Feedwordpress
CVE-2024-0839
Risk Score
Threat Entry
Updated 2026-06-17
Feedwordpress - Cross-Site Scripting (XSS) (CVE-2021-25055)
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
PLUGIN
Feedwordpress
CVE-2021-25055
Risk Score
Threat Entry
Updated 2026-06-17
Feedwordpress - Cross-Site Scripting (XSS) (CVE-2015-9358)
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
PLUGIN
Feedwordpress
CVE-2015-9358
Risk Score
Threat Entry
Updated 2026-06-17
Feedwordpress - SQL Injection (CVE-2015-4018)
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to wp-admin/admin.php.
PLUGIN
Feedwordpress
CVE-2015-4018
Risk Score