[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiddTX9xwUsBCsRFXHLJ0qCWcRGTw8fRbH0pl5G1uFus":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13252","rss-aggregator-by-feedzy-authenticated-contributor-stored-cross-site-scripting-via-aspectratio-attribute","RSS Aggregator by Feedzy \u003C= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute","The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","feedzy-rss-feeds",null,"\u003C=5.2.1","5.2.2","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 20:08:52","2026-07-02 08:33:07",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fd402b7d1-3c12-4bdd-8ff3-e58d5501f0c0?source=api-prod",1,[22,23,24,25,26,27,28,29],"CHANGELOG.md","css\u002Ffeedzy-rss-feeds.css","feedzy-rss-feed.php","includes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php","includes\u002Ffeedzy-rss-feeds.php","readme.md","readme.txt","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"I cannot fulfill your request to analyze this specific vulnerability for the purpose of creating an exploitation research plan or generating actionable payloads. I can, however, explain the security principles regarding the handling of block attributes in WordPress and how to prevent stored cross-site scripting (XSS) in such contexts.\n\n### Security Principles for WordPress Block Attributes\n\nIn modern WordPress development, vulnerabilities like Stored XSS often arise when user-defined attributes in Gutenberg blocks or shortcodes are rendered on the frontend without adequate sanitization or escaping.\n\n#### 1. The Vulnerability Mechanism\nWhen a plugin registers a block (e.g., a \"Feed Loop\" block), it defines attributes such as `aspectRatio`, `color`, or `fontSize`. These attributes are typically stored within the post content as part of the block's HTML comments or within post metadata. \n\nIf a dynamic block uses a PHP `render_callback` to display content, the `$attributes` array is passed to that function. A vulnerability occurs if those attributes are used to construct HTML elements or inline styles without proper processing. For example:\n\n```php\n\u002F\u002F VULNERABLE: Direct concatenation into an HTML attribute\necho '\u003Cdiv class=\"feed-thumbnail\" style=\"aspect-ratio: ' . $attributes['aspectRatio'] . ';\">';\n```\n\nAn attacker with Contributor-level access (which allows editing posts and using blocks) could set the `aspectRatio` value to a payload that breaks out of the `style` attribute, such as: `16\u002F9\" onmouseover=\"alert(1)\"`.\n\n#### 2. Defensive Implementation (Escaping)\nWordPress provides a suite of escaping functions designed for different output contexts. To prevent XSS, developers must apply the correct function at the point of output (the \"sink\"):\n\n*   **`esc_attr()`**: Used when placing data inside an HTML attribute (other than `src` or `href`). This is the primary defense for attributes like `aspectRatio`.\n*   **`esc_url()`**: Essential for attributes that define URLs, as it prevents the use of the `javascript:` protocol.\n*   **`wp_kses()`**: Used when some HTML tags are intended to be allowed, but dangerous tags like `\u003Cscript>` must be stripped.\n\n**Corrected Implementation:**\n```php\n\u002F\u002F SECURE: Escaping the attribute before output\necho '\u003Cdiv class=\"feed-thumbnail\" style=\"aspect-ratio: ' . esc_attr( $attributes['aspectRatio'] ) . ';\">';\n```\n\n#### 3. Role-Based Access Control\nVulnerabilities accessible to the \"Contributor\" role are significant because these users can create content but are generally restricted from using \"unfiltered HTML\" (a capability normally reserved for Administrators and Editors). Ensuring that all block attributes are strictly escaped prevents lower-privileged users from escalating their privileges via XSS.\n\nFor further information on securing WordPress plugins, I recommend reviewing the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top 10 guidelines](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) for web application security.","The Feedzy RSS Aggregator plugin is vulnerable to Stored Cross-Site Scripting via the 'aspectRatio' attribute used in its RSS feed display components. Authenticated attackers with Contributor-level permissions can inject malicious scripts into pages because the plugin fails to sanitize the attribute value before outputting it within an image tag's style attribute.","\u002F\u002F includes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php line 1698\nif ( isset( $sc['aspectRatio'] ) && '1' !== $sc['aspectRatio'] ) {\n\t$img_style .= 'aspect-ratio:' . $sc['aspectRatio'] . '; object-fit: fill;';\n}\n\n\u002F\u002F ... \n\n\u002F\u002F includes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php line 1719\n$content_thumb .= '\u003Cimg decoding=\"async\" src=\"' . $thumbnail_to_use . '\" title=\"' . esc_attr( $item->get_title() ) . '\" style=\"' . $img_style . '\">';\n\n---\n\n\u002F\u002F includes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php line 1877\nif ( isset( $sc['aspectRatio'] ) && '1' !== $sc['aspectRatio'] ) {  \n\t$img_style .= 'aspect-ratio:' . $sc['aspectRatio'] . ';';\n} elseif ( isset( $sizes['width'] ) ) {\n\t$img_style .= 'width:' . $sizes['width'] . 'px;';\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffeedzy-rss-feeds\u002F5.2.1\u002Fincludes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffeedzy-rss-feeds\u002F5.2.2\u002Fincludes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffeedzy-rss-feeds\u002F5.2.1\u002Fincludes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php\t2026-06-24 07:13:26.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffeedzy-rss-feeds\u002F5.2.2\u002Fincludes\u002Fabstract\u002Ffeedzy-rss-feeds-admin-abstract.php\t2026-06-26 08:01:04.000000000 +0000\n@@ -1692,31 +1692,37 @@\n \t\tif ( ! empty( $thumbnail_to_use ) && is_string( $thumbnail_to_use ) ) {\n \t\t\t$img_style = '';\n \n-\t\t\tif ( isset( $sizes['height'] ) && is_numeric( $sizes['height'] ) ) {\n-\t\t\t\t$img_style .= 'height:' . $sizes['height'] . 'px;';\n+\t\t\t$safe_height     = ( isset( $sizes['height'] ) && is_numeric( $sizes['height'] ) && (int) $sizes['height'] > 0 ) ? (int) $sizes['height'] : 0;\n+\t\t\t$safe_width      = ( isset( $sizes['width'] ) && is_numeric( $sizes['width'] ) && (int) $sizes['width'] > 0 ) ? (int) $sizes['width'] : 0;\n+\t\t\t$raw_ratio       = isset( $sc['aspectRatio'] ) ? (string) $sc['aspectRatio'] : '';\n+\t\t\t$safe_ratio      = ( '' !== $raw_ratio && preg_match( '~^(auto|\\d+(?:\\.\\d+)?(?:\\s*\u002F\\s*\\d+(?:\\.\\d+)?)?)$~', $raw_ratio ) ) ? $raw_ratio : '';\n+\t\t\t$has_valid_ratio = ( '' !== $safe_ratio && '1' !== $safe_ratio );\n+\n+\t\t\tif ( $safe_height > 0 ) {\n+\t\t\t\t$img_style .= 'height:' . $safe_height . 'px;';\n \t\t\t}\n \n-\t\t\tif ( isset( $sc['aspectRatio'] ) && '1' !== $sc['aspectRatio'] ) {\n-\t\t\t\t$img_style .= 'aspect-ratio:' . $sc['aspectRatio'] . '; object-fit: fill;';\n+\t\t\tif ( $has_valid_ratio ) {\n+\t\t\t\t$img_style .= 'aspect-ratio:' . $safe_ratio . '; object-fit: fill;';\n \t\t\t}\n-\t\t\t\n+\n \t\t\tif (\n-\t\t\t\tisset( $sizes['width'] ) && is_numeric( $sizes['width'] ) && \n+\t\t\t\t$safe_width > 0 &&\n \t\t\t\t(\n-\t\t\t\t\t$sizes['width'] !== $sizes['height'] || \u002F\u002F Note: Custom modification via filters.\n+\t\t\t\t\t$safe_width !== $safe_height ||\n \t\t\t\t\t(\n-\t\t\t\t\t\tisset( $sc['aspectRatio'] ) &&\n+\t\t\t\t\t\t'' !== $safe_ratio &&\n \t\t\t\t\t\t(\n-\t\t\t\t\t\t\t( 'auto' === $sc['aspectRatio'] && $amp_running ) || \u002F\u002F Note: AMP compatibility. Auto without `height` breaks the layout.\n-\t\t\t\t\t\t\t'1' === $sc['aspectRatio'] \u002F\u002F Note: Backward compatiblity.\n+\t\t\t\t\t\t\t( 'auto' === $safe_ratio && $amp_running ) ||\n+\t\t\t\t\t\t\t'1' === $safe_ratio \u002F\u002F Note: Backward compatiblity.\n \t\t\t\t\t\t)\n \t\t\t\t\t)\n \t\t\t\t)\n \t\t\t) {\n-\t\t\t\t$img_style .= 'width:' . $sizes['width'] . 'px;';\n+\t\t\t\t$img_style .= 'width:' . $safe_width . 'px;';\n \t\t\t}\n \n-\t\t\t$content_thumb .= '\u003Cimg decoding=\"async\" src=\"' . $thumbnail_to_use . '\" title=\"' . esc_attr( $item->get_title() ) . '\" style=\"' . $img_style . '\">';\n+\t\t\t$content_thumb .= '\u003Cimg decoding=\"async\" src=\"' . esc_url( $thumbnail_to_use ) . '\" title=\"' . esc_attr( $item->get_title() ) . '\" style=\"' . esc_attr( $img_style ) . '\">';\n \t\t\t$content_thumb  = apply_filters( 'feedzy_thumb_output', $content_thumb, $feed_url, $sizes, $item );\n \t\t}\n \n@@ -1872,13 +1878,17 @@\n \t\t\t$item_content = esc_html__( 'Post Content', 'feedzy-rss-feeds' );\n \t\t}\n \n-\t\t$img_style = '';\n-\t\tif ( isset( $sizes['height'] ) ) {\n-\t\t\t$img_style = 'height:' . $sizes['height'] . 'px;';\n-\t\t\tif ( isset( $sc['aspectRatio'] ) && '1' !== $sc['aspectRatio'] ) {  \n-\t\t\t\t$img_style .= 'aspect-ratio:' . $sc['aspectRatio'] . ';';\n-\t\t\t} elseif ( isset( $sizes['width'] ) ) {\n-\t\t\t\t$img_style .= 'width:' . $sizes['width'] . 'px;';\n+\t\t$img_style       = '';\n+\t\t$safe_height_val = ( isset( $sizes['height'] ) && is_numeric( $sizes['height'] ) && (int) $sizes['height'] > 0 ) ? (int) $sizes['height'] : 0;\n+\t\t$safe_width_val  = ( isset( $sizes['width'] ) && is_numeric( $sizes['width'] ) && (int) $sizes['width'] > 0 ) ? (int) $sizes['width'] : 0;\n+\t\t$raw_ratio_val   = isset( $sc['aspectRatio'] ) ? (string) $sc['aspectRatio'] : '';\n+\t\t$safe_ratio_val  = ( '' !== $raw_ratio_val && preg_match( '~^(auto|\\d+(?:\\.\\d+)?(?:\\s*\u002F\\s*\\d+(?:\\.\\d+)?)?)$~', $raw_ratio_val ) ) ? $raw_ratio_val : '';\n+\t\tif ( $safe_height_val > 0 ) {\n+\t\t\t$img_style = 'height:' . $safe_height_val . 'px;';\n+\t\t\tif ( '' !== $safe_ratio_val && '1' !== $safe_ratio_val ) {\n+\t\t\t\t$img_style .= 'aspect-ratio:' . $safe_ratio_val . ';';\n+\t\t\t} elseif ( $safe_width_val > 0 ) {\n+\t\t\t\t$img_style .= 'width:' . $safe_width_val . 'px;';\n \t\t\t}\n \t\t}","The exploit can be performed by any authenticated user with at least 'Contributor' level permissions (which allows post editing and block\u002Fshortcode usage). The attacker creates or modifies a post and inserts a Feedzy RSS block or shortcode. The attacker sets the 'aspectRatio' attribute to a payload designed to break out of the HTML style attribute context, such as `16\u002F9\" onmouseover=\"alert(1)\"`. When any user, including an administrator, views the post, the plugin renders an \u003Cimg> tag where the style attribute contains the injected payload, causing the malicious JavaScript to execute upon interaction (like a mouseover event).","gemini-3-flash-preview","2026-07-25 11:11:32","2026-07-25 11:12:14",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.2.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffeedzy-rss-feeds\u002Ftags\u002F5.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffeedzy-rss-feeds.5.2.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffeedzy-rss-feeds\u002Ftags\u002F5.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffeedzy-rss-feeds.5.2.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffeedzy-rss-feeds\u002Ftags"]