RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator vulnerabilities

Product

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

by themeisle · last CVE Oct 29, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities16 In the news0 Timeline

Severity mix

Critical 0High 2Medium 14Low 0

Severity

All severities16 Critical0 High2 Medium14 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-1318	6.5	1%	Feb 20	RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication Affected: through 4.4.2
CVE-2026-104735	6.4	0%	Oct 10	RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> Affected: through 5.2.10
CVE-2026-13252	6.4	0%	Jul 2	RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute Affected: through 5.2.1
CVE-2023-6805	6.4	0%	Apr 17	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF) Affected: through 4.4.7
CVE-2025-11467	5.8	0%	Dec 11	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery Affected: through 5.1.1
CVE-2023-6877	5.4	0%	Apr 7	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message Affected: through 4.3.3
CVE-2023-6798	5.4	0%	Jan 6	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization Affected: through 4.3.2
CVE-2023-6801	5.4	0%	Jan 6	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting Affected: through 4.3.2
CVE-2024-1047	5.3	1%	Feb 2	ThemeIsle SDK <= Various Versions - Missing Authorization Affected: through 4.4.1
CVE-2025-11128	5.0	0%	Oct 23	Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery Affected: through 5.1.0
CVE-2026-110707 New	4.7	0%	Oct 29	RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element Affected: through 5.2.12
CVE-2026-8976	4.3	0%	Jun 5	RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions Affected: through 5.1.7
CVE-2024-1092	4.3	0%	Feb 5	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization Affected: through 4.4.1
CVE-2020-36758	4.3	0%	Oct 20	RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass Affected: before 3.4.3