VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 12 known issues Latest disclosed Jun 05, 2026

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerabilities

Review known vulnerability records for the WordPress plugin RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (`feedzy-rss-feeds`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-8976, CVE-2025-11467 and CVE-2025-11128, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
12
High or Critical
1
Patch Coverage
100%
Last Updated
Jun 05, 2026
Related Security Guides

Use these guides while reviewing RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
12
1. Match the Package
Confirm the installed WordPress plugin slug is feedzy-rss-feeds before acting on any CVE from this cluster.
2. Sort by Severity
Start with 1 high or critical record, then review medium and unrated findings with public references.
3. Check Patch Evidence
12 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2024-1317 High
SQL Injection remediation for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Affected range: Versions up to 4.4.2. Fixed version: 4.4.3.

CVE-2024-1318 Medium
Vulnerability remediation for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Affected range: Versions up to 4.4.2. Fixed version: 4.4.3.

CVE-2023-6805 Medium
Server-Side Request Forgery remediation for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Affected range: Versions up to 4.4.7. Fixed version: 4.4.8.

CVE-2023-6877 Medium
Stored Cross-Site Scripting remediation for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Affected range: Versions up to 4.3.3. Fixed version: 4.3.4.

Priority CVE Quick Links

Fast paths into RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
12
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2024-1317
RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection
 SQL Injection Versions up to 4.4.2 4.4.3 CVSS 8.8
CVE-2024-1318
RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation...
 Vulnerability Versions up to 4.4.2 4.4.3 CVSS 6.5
CVE-2023-6805
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Ag...
 Server-Side Request Forgery Versions up to 4.4.7 4.4.8 CVSS 6.4
CVE-2023-6877
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Ag...
 Stored Cross-Site Scripting Versions up to 4.3.3 4.3.4 CVSS 6.4
CVE-2023-6801
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Ag...
 Stored Cross-Site Scripting Versions up to 4.3.2 4.3.3 CVSS 6.4
CVE-2022-4667
RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site S...
 Stored Cross-Site Scripting Versions up to 4.1.0 4.1.1 CVSS 6.4
CVE-2025-11467
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Ag...
 Server-Side Request Forgery Versions up to 5.1.1 5.1.2 CVSS 5.8
CVE-2023-6798
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Ag...
 Vulnerability Versions up to 4.3.2 4.3.3 CVSS 5.4
CVE-2024-1317 High 4.4.3
CVE-2024-1317 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator SQL Injection

RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection

CVE-2024-1318 Medium 4.4.3
CVE-2024-1318 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerability

RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication

CVE-2023-6805 Medium 4.4.8
CVE-2023-6805 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Server-Side Request Forgery

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

CVE-2023-6877 Medium 4.3.4
CVE-2023-6877 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Stored Cross-Site Scripting

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message

CVE-2023-6801 Medium 4.3.3
CVE-2023-6801 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Stored Cross-Site Scripting

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting

CVE-2022-4667 Medium 4.1.1
CVE-2022-4667 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Stored Cross-Site Scripting

RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVE-2025-11467 Medium 5.1.2
CVE-2025-11467 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Server-Side Request Forgery

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery

CVE-2023-6798 Medium 4.3.3
CVE-2023-6798 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerability

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
12 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2026-8976, CVE-2025-11467 and CVE-2025-11128
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

CVE-2026-8976 Medium Patch path listed

CVE-2026-8976: RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi...

Published
Jun 05, 2026
Patch Status
5.1.8
Review CVE-2026-8976 affected versions
Known Vulnerabilities

Reports for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-8976
CVE-2026-8976: RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to p...

Published
Jun 05, 2026
Patched Release
5.1.8
Affected Versions
Versions up to 5.1.7
Next Step
Update to 5.1.8 or newer if supported.
Review CVE-2026-8976 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11467
CVE-2025-11467: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unaut...

Published
Dec 10, 2025
Patched Release
5.1.2
Affected Versions
Versions up to 5.1.1
Next Step
Update to 5.1.2 or newer if supported.
Review CVE-2025-11467 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11128
CVE-2025-11128: Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for auth...

Published
Oct 22, 2025
Patched Release
5.1.1
Affected Versions
Versions up to 5.1.0
Next Step
Update to 5.1.1 or newer if supported.
Review CVE-2025-11128 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6805
CVE-2023-6805: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authen...

Published
Apr 16, 2024
Patched Release
4.4.8
Affected Versions
Versions up to 4.4.7
Next Step
Update to 4.4.8 or newer if supported.
Review CVE-2023-6805 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6877
CVE-2023-6877: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.3.3 due to insufficient input sanitization and...

Published
Apr 06, 2024
Patched Release
4.3.4
Affected Versions
Versions up to 4.3.3
Next Step
Update to 4.3.4 or newer if supported.
Review CVE-2023-6877 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2024-1317
CVE-2024-1317: RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘search_key’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parame...

Published
Feb 09, 2024
Patched Release
4.4.3
Affected Versions
Versions up to 4.4.2
Next Step
Update to 4.4.3 or newer if supported.
Review CVE-2024-1317 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1318
CVE-2024-1318: RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all vers...

Published
Feb 09, 2024
Patched Release
4.4.3
Affected Versions
Versions up to 4.4.2
Next Step
Update to 4.4.3 or newer if supported.
Review CVE-2024-1318 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1092
CVE-2024-1092: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the feedzy dashboard in all versions up to, and including, 4.4.1. This makes...

Published
Feb 02, 2024
Patched Release
4.4.2
Affected Versions
Versions up to 4.4.1
Next Step
Update to 4.4.2 or newer if supported.
Review CVE-2024-1092 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6798
CVE-2023-6798: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it...

Published
Jan 05, 2024
Patched Release
4.3.3
Affected Versions
Versions up to 4.3.2
Next Step
Update to 4.3.3 or newer if supported.
Review CVE-2023-6798 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6801
CVE-2023-6801: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output esca...

Published
Jan 05, 2024
Patched Release
4.3.3
Affected Versions
Versions up to 4.3.2
Next Step
Update to 4.3.3 or newer if supported.
Review CVE-2023-6801 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-4667
CVE-2022-4667: RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for au...

Published
Jan 04, 2023
Patched Release
4.1.1
Affected Versions
Versions up to 4.1.0
Next Step
Update to 4.1.1 or newer if supported.
Review CVE-2022-4667 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2020-36758
CVE-2020-36758: RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated att...

Published
Sep 16, 2020
Patched Release
3.4.3
Affected Versions
Versions before 3.4.3
Next Step
Update to 3.4.3 or newer if supported.
Review CVE-2020-36758 fixed version details Open CVE Reference