# CVE-2026-110530: CVE-2026-110530

Status: published. Published: 2026-10-31. Updated: 2026-11-01.

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 7.2 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N; source: NVD: security@wordfence.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://plugins.trac.wordpress.org/browser/feedwordpress/ (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L1196 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L1726 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L395 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.1016/syndicatedpost.class.php (security@wordfence.com)

- https://www.wordfence.com/threat-intel/vulnerabilities/id/cad2334c-21f5-40bc-8b08-32c12ce1e077?source=cve (security@wordfence.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110530; retrieved 2026-11-02; source updated 2026-11-01

Revision: f5f066e6e4ab12f4b2dfec494da50f69eafbf115abea8d47166020422e2d04c4

Canonical: https://y2.dev/cve/CVE-2026-110530