CVE-2023-6805mediumCWE-918

CVE-2023-6805: medium-severity vulnerability in themeisle RSS Aggregator by Feedzy – Feed to…

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

Published · Updated

Follow this CVE+ Monitor RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.3%
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
themeisle · RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Related CVEs — themeisle RSS Aggregator by Feedzy – Feed to…

In the same product, most dangerous first.

CVE-2024-1317HIGHRSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL InjectionEPSS 0.7%CVE-2024-1047MEDIUMThemeIsle SDK <= Various Versions - Missing AuthorizationEPSS 0.6%CVE-2024-1318MEDIUMRSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and PublicationEPSS 0.5%CVE-2020-36758MEDIUMRSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2024-1092MEDIUMRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing AuthorizationEPSS 0.4%CVE-2026-13252MEDIUMRSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' AttributeEPSS 0.3%