CVE-2026-4069 Alfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter
Attackers can inject malicious scripts via the 'naam' parameter, leading to stored XSS and potential admin account takeover if an administrator is tricked into clicking a link.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-4069?
CVE-2026-4069 is a medium-severity cross-site scripting vulnerability in pftool Alfie – Feed Plugin, published on 21 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.
Weakness: CWE-79
Which versions are affected by CVE-2026-4069?
How do I fix CVE-2026-4069?
No fix has been published for CVE-2026-4069 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-4069 being exploited?
There is no known exploitation of CVE-2026-4069 in the wild and no public exploit code.
Sources
Also known as GHSA-pmq6-5285-2f6f.