CVE-2026-110530 radgeek CVE debrief

Who should care

Defenders responsible for WordPress installations with the FeedWordPress plugin should assess exposure and prioritize verification and remediation. This includes reviewing the plugin's configuration, verifying the version, and implementing compensating controls if necessary. Additionally, security teams and vulnerability management teams should be aware of the vulnerability and its potential impact on their organization's WordPress deployments.

Why it matters

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying and updating the plugin, assessing exposure, and implementing compensating controls. Evidence is limited, and further verification is required to determine affected versions and remediation details.

• Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
• Defenders must verify and update the FeedWordPress plugin to a fixed version to prevent exploitation
• Exposure requires verification from official sources, as affected versions and remediation details are limited

Technical summary

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute, and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post().

Defensive priority

Defenders should prioritize verifying and updating the FeedWordPress plugin to a fixed version, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify and update the FeedWordPress plugin to a fixed version
• Assess exposure and implement compensating controls
• Monitor for suspicious activity and implement additional security measures
• Review official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected versions. Evidence is limited, and further verification is required to determine affected versions and remediation details. The FeedWordPress plugin's SyndicatedPost class has been identified as a key component in the vulnerability. Official sources, such as the CVE Program and NVD, provide additional context and guidance on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.