Add To Feedly Vulnerabilities

The Add to Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.11. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site admini...

CVSS:

4.3

Affected:

up to 1.2.11

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58859 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Add to Feedly allows Stored XSS. This issue affects Add to Feedly: from n/a through 1.2.11.

Affected:

up to 1.2.11

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58859 on NVD →

[en] The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected:

up to 1.2.11

Fix:

No patched version reported

Disclosed:

May 30, 2023

CVE-2023-2470 on NVD →

The Add to Feedly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitr...

CVSS:

4.4

Affected:

up to 1.2.11

Fix:

No patched version reported

Disclosed:

May 2, 2023

CVE-2023-2470 on NVD →