CVE-2023-6805

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.

• CWE-918
• CWE-918

• https://plugins.trac.wordpress.org/changeset/3070624/feedzy-rss-feedsPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/46978e1d-7adb-49f6-8e41-093f177c9a4d?source=cveVendor Advisory
• https://plugins.trac.wordpress.org/changeset/3070624/feedzy-rss-feedsPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/46978e1d-7adb-49f6-8e41-093f177c9a4d?source=cveVendor Advisory

Published

Apr 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6798The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…5.4
• CVE-2023-6799The WP Reset – Most Advanced WordPress Reset Tool plugin for…5.9
• CVE-2023-6801The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…5.4
• CVE-2023-6802An insertion of sensitive information into the log file in t…6.5
• CVE-2023-6803A race condition in GitHub Enterprise Server allows an outsi…4
• CVE-2023-6804Improper privilege management allowed arbitrary workflows to…5.5
• CVE-2023-6806The Starbox plugin for WordPress is vulnerable to Stored Cro…5.4
• CVE-2023-6807The GeneratePress Premium plugin for WordPress is vulnerable…5.4
• CVE-2023-6808The Booking for Appointments and Events Calendar – Amelia pl…5.4
• CVE-2023-6809The Custom fields shortcode plugin for WordPress is vulnerab…5.4
• CVE-2023-6810The ClickCease Click Fraud Protection plugin for WordPress i…4.3
• CVE-2023-6811The Language Translate Widget for WordPress – ConveyThis plu…7.2