CVE-2026-4069
Stored XSS in Alfie – Feed Plugin for WordPress Allows Admin Hijacking
Publication date: 2026-03-21
Last updated on: 2026-03-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| alfie | alfie_feed_plugin | to 1.2.1 (inc) |
| alfie | feed_plugin | to 1.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Alfie – Feed Plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'naam' parameter in all versions up to and including 1.2.1. This vulnerability exists because the plugin's alfie_option_page() function lacks nonce validation and does not properly sanitize or escape input and output. As a result, unauthenticated attackers can inject malicious scripts that get stored in the plugin's database and execute when a user views the affected page.
An attacker can exploit this by tricking a site administrator into performing an action, such as clicking a malicious link, which then triggers the execution of the injected script.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the context of the affected website when an administrator views the compromised page. This can lead to unauthorized actions such as stealing administrator session cookies, defacing the website, or performing actions on behalf of the administrator.
Since the vulnerability requires user interaction (an administrator clicking a link), it can be used to escalate attacks by compromising administrative control over the site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know