PLUGIN SECURITY
Is Feedzy Rss Feeds safe?
The most powerful WordPress RSS aggregator, helping you curate content, autoblog, import RSS & display unlimited RSS feeds within a few minutes.
What this plugin does
- Slug:
feedzy-rss-feeds - Author: Themeisle
- 40000+ active installs
- 92/100 rating (361 reviews on wordpress.org)
- 3184039 all-time downloads
- On WordPress.org since 2014-11-03
autobloggingfeed to postnews aggregatorrss aggregatorrss import
Maintenance status
- Latest known version: 5.2.7
- Last updated: 2026-08-20 6:29pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.2+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
23 known CVEs on file for Feedzy Rss Feeds.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-18934 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 5.2.6 | Incorrect Authorization | Unknown | < 5.2.6 | 5.2.6 | 2026-07-27 | ✓ fixed in latest |
| CVE-2026-13252 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 5.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.2.2 | 5.2.2 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-8976 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 5.1.8 | Missing Authorization | Medium 4.3 | < 5.1.8 | 5.1.8 | 2026-06-05 | ✓ fixed in latest |
| CVE-2025-11467 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 5.1.2 | Server-Side Request Forgery (SSRF) | Medium 5.8 | < 5.1.2 | 5.1.2 | 2025-12-10 | ✓ fixed in latest |
| CVE-2025-11128 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 5.1.1 | Server-Side Request Forgery (SSRF) | Medium 5.0 | < 5.1.1 | 5.1.1 | 2025-10-22 | ✓ fixed in latest |
| CVE-2023-6805 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.4.8 | Server-Side Request Forgery (SSRF) | Medium 6.4 | < 4.4.8 | 4.4.8 | 2024-04-16 | ✓ fixed in latest |
| CVE-2023-6877 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.3.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.3.4 | 4.3.4 | 2024-04-06 | ✓ fixed in latest |
| CVE-2024-1317 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.4.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 4.4.3 | 4.4.3 | 2024-02-09 | ✓ fixed in latest |
+ 13 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-1318 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.4.3 | Missing Authorization | Medium 6.5 | < 4.4.3 | 4.4.3 | 2024-02-09 | ✓ fixed in latest |
| CVE-2024-1092 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.4.2 | Improper Access Control | Medium 4.3 | < 4.4.2 | 4.4.2 | 2024-02-02 | ✓ fixed in latest |
| CVE-2023-6801 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.3.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.3.3 | 4.3.3 | 2024-01-05 | ✓ fixed in latest |
| CVE-2023-6798 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.3.3 | Storing Passwords in a Recoverable Format | Medium 5.4 | < 4.3.3 | 4.3.3 | 2024-01-05 | ✓ fixed in latest |
| CVE-2021-4342 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 3.4.3 | — | Unknown | < 3.4.3 | 3.4.3 | 2023-06-07 | ✓ fixed in latest |
| CVE-2022-4667 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 4.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.1.1 | 4.1.1 | 2023-01-04 | ✓ fixed in latest |
| — | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 3.4.3 | — | Unknown | < 3.4.3 | 3.4.3 | 2020-09-16 | ✓ fixed in latest |
| CVE-2020-36758 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 3.4.3 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.4.3 | 3.4.3 | 2020-09-16 | ✓ fixed in latest |
| — | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 5.2.5 | — | Unknown | < 5.2.5 | 5.2.5 | 0000-00-00 | ✓ fixed in latest |
| — | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds] < 3.4.3 | — | Unknown | < 3.4.3 | 3.4.3 | — | ✓ fixed in latest |
| CVE-2020-36707, CVE-2021-4417, CVE-2020-36752, CVE-2020-36757, CVE-2020-36756, CVE-2020-36761, CVE-2020-36760, CVE-2020-36760 | Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF) | — | Unknown | < 3.4.3 | 3.4.3 | — | ✓ fixed in latest |
| CVE-2024-1092 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator < 4.4.2 - Missing Authorization | — | Unknown | < 4.4.2 | 4.4.2 | — | ✓ fixed in latest |
| CVE-2026-66437 | Feedzy < 5.2.5 - Authenticated (Contributor+) Server-Side Request Forgery | — | Unknown | < 5.2.5 | 5.2.5 | — | ✓ fixed in latest |
How to fix it
Keep Feedzy Rss Feeds updated — 5.2.7 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content — 40000+ active installs — 90/100 (561) — max PHP <8.0
- WPeMatico RSS Feed Fetcher — 10000+ active installs — 96/100 (514) — max PHP 8.4
- Arvow AI SEO Writer — 1000+ active installs — 46/100 (3) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.