https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 03 Nov 2026 11:03:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110530 <p>The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin&#39;s SyndicatedPost::sanitize_content() function only strips the &#39;target&#39; attribute (the lines that would strip &#39;style&#39; and &#39;on[a-z]+&#39; event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress&#39;s wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin&#39;s SyndicatedPost::sanitize_content() function only strips the &#39;target&#39; attribute (the lines that would strip &#39;style&#39; and &#39;on[a-z]+&#39; event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress&#39;s wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110530 https://db.gcve.eu/vuln/ghsa-cr3r-cx3j-65fh <p>The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin&#39;s SyndicatedPost::sanitize_content() function only strips the &#39;target&#39; attribute (the lines that would strip &#39;style&#39; and &#39;on[a-z]+&#39; event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress&#39;s wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin&#39;s SyndicatedPost::sanitize_content() function only strips the &#39;target&#39; attribute (the lines that would strip &#39;style&#39; and &#39;on[a-z]+&#39; event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress&#39;s wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://db.gcve.eu/vuln/ghsa-cr3r-cx3j-65fh