VulnSocial

CVE-2026-4069Disclosure

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-21: 2Technical Details · 2026-03-21: 203-21
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-4069 Stored XSS Vulnerability in WordPress Alfie – Feed Plugin ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4069 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    A stored XSS vulnerability (CVE-2026-4069) was identified in the WordPress Alfie – Feed Plugin, with reference to vulnerability details, but no PoC, exploit code, active exploitation, or mitigation was provided.

    0000027
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-4069 The Alfie – Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is … https://www.cve.org/CVERecord?id=CVE-2026-4069

    Post summary

    The CVE-2026-4069 points to a stored XSS vulnerability in the Alfie – Feed Plugin for WordPress via the 'naam' parameter in all versions up to 1.2.1. No PoC, exploit, patch, or active exploitation details are included.

    0000071
    56.8K followersView on X

Explore more

Back to dashboard