VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 11 known issues Latest disclosed Dec 10, 2025

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerabilities

Review known vulnerability records for the WordPress plugin RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (`feedzy-rss-feeds`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-11467, CVE-2025-11128 and CVE-2023-6805, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
11
High or Critical
1
Patch Coverage
100%
Last Updated
Dec 11, 2025
Priority CVE Quick Links

Fast paths into RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
11
CVE-2024-1317 High 4.4.3
CVE-2024-1317 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator SQL Injection

RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection

CVE-2024-1318 Medium 4.4.3
CVE-2024-1318 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerability

RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication

CVE-2023-6805 Medium 4.4.8
CVE-2023-6805 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Server-Side Request Forgery

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

CVE-2023-6877 Medium 4.3.4
CVE-2023-6877 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Stored Cross-Site Scripting

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message

CVE-2023-6801 Medium 4.3.3
CVE-2023-6801 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Stored Cross-Site Scripting

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting

CVE-2022-4667 Medium 4.1.1
CVE-2022-4667 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Stored Cross-Site Scripting

RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVE-2025-11467 Medium 5.1.2
CVE-2025-11467 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Server-Side Request Forgery

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery

CVE-2023-6798 Medium 4.3.3
CVE-2023-6798 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vulnerability

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
11 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2025-11467, CVE-2025-11128 and CVE-2023-6805
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-11467
CVE-2025-11467: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unaut...

Published
Dec 10, 2025
Patched Release
5.1.2
Affected Versions
Versions up to 5.1.1
Next Step
Update to 5.1.2 or newer if supported.
Open CVE-2025-11467 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11128
CVE-2025-11128: Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for auth...

Published
Oct 22, 2025
Patched Release
5.1.1
Affected Versions
Versions up to 5.1.0
Next Step
Update to 5.1.1 or newer if supported.
Open CVE-2025-11128 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6805
CVE-2023-6805: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authen...

Published
Apr 16, 2024
Patched Release
4.4.8
Affected Versions
Versions up to 4.4.7
Next Step
Update to 4.4.8 or newer if supported.
Open CVE-2023-6805 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6877
CVE-2023-6877: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.3.3 due to insufficient input sanitization and...

Published
Apr 06, 2024
Patched Release
4.3.4
Affected Versions
Versions up to 4.3.3
Next Step
Update to 4.3.4 or newer if supported.
Open CVE-2023-6877 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-1317
CVE-2024-1317: RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘search_key’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parame...

Published
Feb 09, 2024
Patched Release
4.4.3
Affected Versions
Versions up to 4.4.2
Next Step
Update to 4.4.3 or newer if supported.
Open CVE-2024-1317 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1318
CVE-2024-1318: RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'feedzy_wizard_step_process' and 'import_status' functions in all vers...

Published
Feb 09, 2024
Patched Release
4.4.3
Affected Versions
Versions up to 4.4.2
Next Step
Update to 4.4.3 or newer if supported.
Open CVE-2024-1318 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-1092
CVE-2024-1092: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the feedzy dashboard in all versions up to, and including, 4.4.1. This makes...

Published
Feb 02, 2024
Patched Release
4.4.2
Affected Versions
Versions up to 4.4.1
Next Step
Update to 4.4.2 or newer if supported.
Open CVE-2024-1092 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6798
CVE-2023-6798: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it...

Published
Jan 05, 2024
Patched Release
4.3.3
Affected Versions
Versions up to 4.3.2
Next Step
Update to 4.3.3 or newer if supported.
Open CVE-2023-6798 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6801
CVE-2023-6801: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output esca...

Published
Jan 05, 2024
Patched Release
4.3.3
Affected Versions
Versions up to 4.3.2
Next Step
Update to 4.3.3 or newer if supported.
Open CVE-2023-6801 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-4667
CVE-2022-4667: RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for au...

Published
Jan 04, 2023
Patched Release
4.1.1
Affected Versions
Versions up to 4.1.0
Next Step
Update to 4.1.1 or newer if supported.
Open CVE-2022-4667 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2020-36758
CVE-2020-36758: RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated att...

Published
Sep 16, 2020
Patched Release
3.4.3
Affected Versions
Versions before 3.4.3
Next Step
Update to 3.4.3 or newer if supported.
Open CVE-2020-36758 Report Open CVE Reference