PT-2026-26871 · WordPress · Alfie – Feed Plugin

Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4069

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alfie – Feed Plugin versions up to and including 1.2.1

Description The Alfie – Feed Plugin plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to missing nonce validation on the alfie option page() function combined with insufficient input sanitization and output escaping of the naam parameter. This allows unauthenticated attackers to inject malicious web scripts into the plugin’s database. These scripts will execute when a user accesses the page displaying the injected data, if an administrator is tricked into performing an action such as clicking a link.

Recommendations Update Alfie – Feed Plugin to a version later than 1.2.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4069

Affected Products

Alfie – Feed Plugin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-4069 · Security Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L60-L60 · Note
• https://twitter.com/CVEnew/status/2035237289321013697 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/440ff558-d304-4c2e-b9e2-988b31dcbcb6?source=cve · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L75-L75 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L104-L104 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L59-L59 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L59-L59 · Note
• https://twitter.com/VulmonFeeds/status/2035251113717317658 · Twitter Post
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L104-L104 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L75-L75 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L60-L60 · Note