PULSE
EN
FEED
ransomchaos reclama a mickeybody.com · US · Retail & E-Commerceransomaurora reclama a ARX Group SA · CH · Otherransomwhitearmor reclama a whitearmor.cc · Technologyransomlockbit5 reclama a dorsiacademy.it · IT · Educationransomlockbit5 reclama a mlh.com.lb · LB · Professional Servicesransomlockbit5 reclama a lidoway.com · LI · Not Foundransomlockbit5 reclama a zelsior.es · ES · Not Foundransomemperador reclama a JS Constructor, INC · US · Manufacturingransomwhitearmor reclama a Whirlpool · US · Manufacturingransomwhitearmor reclama a JB Hunt · US · Transportationransomqilin reclama a Labaid Cancer Hospital And Super Speciality Center · BD · Healthcareransomqilin reclama a Kale Balata A · TR · Agriculture and Food Productionransomqilin reclama a MaxiSeguridad · AR · Professional Servicesransomqilin reclama a Aryza · AR · Technologyransomchaos reclama a mickeybody.com · US · Retail & E-Commerceransomaurora reclama a ARX Group SA · CH · Otherransomwhitearmor reclama a whitearmor.cc · Technologyransomlockbit5 reclama a dorsiacademy.it · IT · Educationransomlockbit5 reclama a mlh.com.lb · LB · Professional Servicesransomlockbit5 reclama a lidoway.com · LI · Not Foundransomlockbit5 reclama a zelsior.es · ES · Not Foundransomemperador reclama a JS Constructor, INC · US · Manufacturingransomwhitearmor reclama a Whirlpool · US · Manufacturingransomwhitearmor reclama a JB Hunt · US · Transportationransomqilin reclama a Labaid Cancer Hospital And Super Speciality Center · BD · Healthcareransomqilin reclama a Kale Balata A · TR · Agriculture and Food Productionransomqilin reclama a MaxiSeguridad · AR · Professional Servicesransomqilin reclama a Aryza · AR · Technology
← Todos los CVEs
CVE Watch13 oct 2026

CVE-2026-104735

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store

CVSS

6.4

Medio

EPSS

0.2%

p11

KEV

—

Exploit Today

3

0-100

Publicado: 10 oct 2026 · Última mod.: 13 oct 2026 · CWE-79

EPSS · 30d
0.2%EPSS · 30 días0.2%
2026-10-102026-10-23
Descripción técnica

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-879018.3 ALT
—
———Improper sanitization in the registration module allows reflected Cross-Site Scripting.6hCVE-2026-554869.3 CRÍ
—
———The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.7hCVE-2026-1123335.4 MED
—
———GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.8hCVE-2026-102786—
—
———Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.58hCVE-2026-936386.1 MED
—
———A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.6hCVE-2026-936335.4 MED
—
———A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.6h