EUVD-2026-102798

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wpfilterpostkses filter from contentsavepre immediately before calling wpinsertpost with RSS feed content, whenever...

CVE-2026-110252 WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wpfilterpostkses filter from contentsavepre immediately before calling wpinsertpost with RSS feed content, whenever...

CVE-2026-110252

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions up to and including 2.9 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is the plugin's removal of the wp_filter_post_kses filter from content_save_pre before calling wp_insert_post() with RSS feed...

CVE-2026-109207

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...

CVE-2026-109207 RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...

EUVD-2026-102617

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...

CVE-2026-109207

The RSS Aggregator by Feedzy WordPress plugin (versions

PT-2026-116086

WeRSS we-mp-rss through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/feed id endpoint. Attackers can supply a non-built-in ext value and a =expression template whose object-subclass travers...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Elieve in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.9...

WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Feedzy versions = 5.2.11...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI to unauthenticated RCE A self-contained Docker lab that reproduces CVE-2025-24893, a Server-Side Template Injection in XWiki's SolrSearch RSS feed that leads to unauthenticated remote code execution. It runs the vulnerable version 15.10.10 and the patched...

CVE-2023-5612

Disclosure of the public email in Tags RSS Feed https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the...

xwiki-cve-2025-24893-exploit

XWiki CVE-2025-24893 Exploit Unauthenticated Remote Code Execution exploit for XWiki versions vulnerable to CVE-2025-24893. Vulnerability Overview XWiki versions prior to 15.10.9 are vulnerable to unauthenticated RCE through Groovy script injection in the SolrSearch RSS feed handler. The...

CVE-2026-110617

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

CVE-2026-110617 we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

EUVD-2026-101245

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

CVE-2026-110617 we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

CVE-2026-110617

The software we-mp-rss (versions through 1.5.3 ) is vulnerable to a missing authorization issue in the /api/v1/wx/tools/export/download endpoint. The vulnerability exists because the authentication dependency is commented out, allowing unauthenticated attackers to download export archives from th...

ThreatIntel-Aggregator

Threat Intel Aggregator A self-hosted threat intelligence platform that aggregates RSS feeds from 60+ security vendors, runs AI triage, correlates findings against your RunZero asset inventory, and surfaces actionable alerts through a dark-mode web dashboard. Built to run standalone with zero clo...

CVE-2026-104816

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...