CVE-2026-110530

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...

CVE-2026-110530

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2026.0517 . The root cause lies in the SyndicatedPost::sanitize_content() function, which fails to strip style and on[a-z]+ event-handler attributes, and the SyndicatedPost::i...

CVE-2026-110530: radgeek FeedWordPress: The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...