WordPress RSS Aggregator by Feedzy plugin < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability

Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability discovered by Farid Narimanov in WordPress Plugin Feedzy versions 5.2.6...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

EUVD-2026-55013

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-18934: Incorrect Authorization

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-66437

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

EUVD-2026-49244

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

CVE-2026-66437

WordPress Feedzy plugin vulnerability CVE-2026-66437 affects Feedzy

CVE-2026-66437

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

CVE-2026-66437 WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Feedzy versions = 5.2.4...

PT-2026-64964

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

CVE-2026-66437: Server-Side Request Forgery (SSRF)

Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...

📄 WordPress Feedzy RSS Feeds 4.4.1 SQL Injection

WordPress Feedzy RSS Feeds plugin version 4.4.1 contains an authenticated Author+ SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request flow against the...

CVE-2026-13252

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. Th...

CVE-2026-13252 RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. Th...

CVE-2026-13252

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. Th...

CVE-2026-13252

The CVE-2026-13252 entry concerns the WordPress plugin RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator. Affected: the plugin’s handling of the aspectRatio attribute allows Stored Cross-Site Scripting due to insufficient input sanitization and output es...