Plugins · feedwordpress · data as of 2026-11-04
Is FeedWordPress safe? Known vulnerabilities and latest version
- Latest version
- 2026.1030
- Last updated
- 2026-10-30
- Active installs
- 8,000+
- Known issues on record
- 5
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4
FeedWordPress syndicates content from feeds you choose into your WordPress weblog. — by C. Johnson
What to do
- Update to the latest version (2026.1030). Anything older than 2026.1016 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get feedwordpress --field=version shows what you run; wp plugin update feedwordpress updates it.
Check your version
Known vulnerabilities
5 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.2 CVE-2026-110530 · published 2026-10-31
Stored cross-site scripting (XSS) in FeedWordPress (2026.0517 and older)
- Affected
- 2026.0517 and older
- Fixed in
- 2026.1016 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
medium 5.3 CVE-2024-0839 · published 2024-03-13
Missing authorization check in FeedWordPress (2022.0222 and older)
- Affected
- 2022.0222 and older
- Fixed in
- 2024.0428 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.
NVD CVE-2024-0839Wordfence advisoryCode change (fix)wordpress.org
medium 6.1 CVE-2021-25055 · published 2022-02-21
Reflected cross-site scripting (XSS) in FeedWordPress (older than 2022.0123)
- Affected
- older than 2022.0123
- Fixed in
- 2022.0123
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
medium 6.1 CVE-2015-9358 · published 2019-08-28
Cross-site scripting (XSS) in FeedWordPress (older than 2015.0514)
- Affected
- older than 2015.0514
- Fixed in
- 2015.0514
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
medium 6.5 CVE-2015-4018 · published 2015-05-21
SQL injection in FeedWordPress (2014.0805 and older)
- Affected
- 2014.0805 and older
- Fixed in
- 2015.0426 *
- Range from
- NVD analysis · score by NVD
Details from the advisory
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to wp-admin/admin.php.
NVD CVE-2015-4018wordpress.orgpacketstormsecurity.comseclists.orgexploit-db.com
Recent activity
- 2026-10-30 — latest release on wordpress.org (2026.1030).
- 2026-10-31 — Stored cross-site scripting (XSS) disclosed (CVE-2026-110530), fixed in 2026.1016.
- 2024-03-13 — Missing authorization check disclosed (CVE-2024-0839), fixed in 2024.0428.
- 2022-02-21 — Reflected cross-site scripting (XSS) disclosed (CVE-2021-25055), fixed in 2022.0123.
Get an email when FeedWordPress has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for FeedWordPress (feedwordpress) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: Cross-site scripting (XSS) (3) · Missing authorization (1) · SQL injection (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/feedwordpress (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/feedwordpress"><img src="https://laskyr.com/plugins/feedwordpress/badge.svg" alt="FeedWordPress vulnerability status"></a>