PT-2026-26871 · Bpftool · Alfie – Feed Plugin

Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4069

NVD

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie option page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4069

Affected Products

Alfie – Feed Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-4069 · Security Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L59-L59 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L104-L104 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L60-L60 · Note
• https://twitter.com/CVEnew/status/2035237289321013697 · Twitter Post
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L60-L60 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L59-L59 · Note
• https://twitter.com/VulmonFeeds/status/2035251113717317658 · Twitter Post
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L75-L75 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L104-L104 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L75-L75 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/440ff558-d304-4c2e-b9e2-988b31dcbcb6?source=cve · Note